Overview

overview

10

Static

static

REVISED IN...LS.exe

windows7_x64

10

REVISED IN...LS.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    REVISED INVOICE DETAILS.exe

  • Size

    1.2MB

  • Sample

    210726-layc6lre9n

  • MD5

    f085c3358b59f0f7233e460816b9cffd

  • SHA1

    1fa9928211033fd8afadc910e5acbd608d2686d1

  • SHA256

    ac4d23b56b2aac65756dafc7d6ff505ba986f40410370ca4c094f0530e399d79

  • SHA512

    88525849adc8ea59bf90a3e95d284b66514e24a955f059d1be29eab26e9d052d6dcd353668a3330055478b5c982ce508a8aa2aabe42dfc99979c9a4a70637d43

Score
10/10
formbookratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.fabricwarehousebrla.com/mjf5/

Decoy

scxmarine.com

4week-keto-results.com

alllivesmattertojesus.info

stoxets.com

psm-gen.com

u2collect.com

steveandgail.com

dgemediagroup.com

ragsxghi.com

hirobasushinv.com

fcvlamingo.com

thebrownseaproject.com

achalaproductions.com

unstoppableinvesting.com

epay12303.com

polenmoda.com

pgpitagi.com

picksfacts.com

allhubph.com

negociandocomvocebr.com

Targets

    • Target

      REVISED INVOICE DETAILS.exe

    • Size

      1.2MB

    • MD5

      f085c3358b59f0f7233e460816b9cffd

    • SHA1

      1fa9928211033fd8afadc910e5acbd608d2686d1

    • SHA256

      ac4d23b56b2aac65756dafc7d6ff505ba986f40410370ca4c094f0530e399d79

    • SHA512

      88525849adc8ea59bf90a3e95d284b66514e24a955f059d1be29eab26e9d052d6dcd353668a3330055478b5c982ce508a8aa2aabe42dfc99979c9a4a70637d43

    Score
    10/10
    formbookratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks