Overview

overview

10

Static

static

Proforma I...df.exe

windows7_x64

10

Proforma I...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe

  • Size

    612KB

  • Sample

    210726-63nsf2waas

  • MD5

    1b4ef34299d4b6b9d6c8af470be15953

  • SHA1

    5c805afe83fd41d04bc3f119e1a635c2b1ae5f65

  • SHA256

    f5f2c341e235dbe728a9545c0e308f1c3a13c73505da2f72f07874cd63b07031

  • SHA512

    d97d1eaa7071fe5bfc7c0a5908fafb8c6950545887b734d802eea16fbf9904587cd1934984d89ade71f8b1a2e0008c214353adc4ff9ba207035fcfc811f80179

Score
10/10
formbookratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.elitegamerblog.com/gsg0/

Decoy

telprix.com

multiremates.com

heytiday.com

toporganik.com

tutorincranleigh.com

oakandolivemalibu.com

ronaldvalentine.com

waytopshop.com

mythai-massage.com

matrixresults.com

teamwork256.com

qqemas.men

qnmark.com

rock-singer.com

mobiledevpros.com

miramar-agents.com

desjour.com

edensplace.net

ryanrafuls.com

xg8197.com

Targets

    • Target

      Proforma Invoice No.42037 dated 26032021 for USD.78116.pdf.exe

    • Size

      612KB

    • MD5

      1b4ef34299d4b6b9d6c8af470be15953

    • SHA1

      5c805afe83fd41d04bc3f119e1a635c2b1ae5f65

    • SHA256

      f5f2c341e235dbe728a9545c0e308f1c3a13c73505da2f72f07874cd63b07031

    • SHA512

      d97d1eaa7071fe5bfc7c0a5908fafb8c6950545887b734d802eea16fbf9904587cd1934984d89ade71f8b1a2e0008c214353adc4ff9ba207035fcfc811f80179

    Score
    10/10
    formbookratspywarestealertrojansuricata

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks