Overview

overview

10

Static

static

5.exe

windows7_x64

10

5.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5.exe

  • Size

    836KB

  • Sample

    210907-cmg7rsbfc4

  • MD5

    6330abeff519ec21a35d8003bfd28a9a

  • SHA1

    3703b9640c7b0077974444faedd7f3cd785f319c

  • SHA256

    1a7126ebae2322bac10b972bd00d62687e5f5e5b7f59c6ab63b9310180f3ce4e

  • SHA512

    d00c1fb3b48d262d630ca29e176c7adf1e9f559aa3238a65584341b1d0cd233aa88df61208a19aad794cc2923b000892590d28fa897ee83fdb6cf659cf844273

Score
10/10
formbookmodiloader3noppersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nop

C2

http://www.jakesplacebarbers.com/3nop/

Decoy

videohm.com

panache-rose.com

alnooncars-kw.com

trueblue2u.com

brussels-cafe.com

ip2c.net

influenzerr.com

rbcoq.com

zzful.com

drainthe.com

sumaholesson.com

cursosaprovados.com

genotecinc.com

dbrulhart.com

theapiarystudios.com

kensyu-kan.com

dkku88.com

tikhyper.com

aztecnort.com

homebrim.com

Targets

    • Target

      5.exe

    • Size

      836KB

    • MD5

      6330abeff519ec21a35d8003bfd28a9a

    • SHA1

      3703b9640c7b0077974444faedd7f3cd785f319c

    • SHA256

      1a7126ebae2322bac10b972bd00d62687e5f5e5b7f59c6ab63b9310180f3ce4e

    • SHA512

      d00c1fb3b48d262d630ca29e176c7adf1e9f559aa3238a65584341b1d0cd233aa88df61208a19aad794cc2923b000892590d28fa897ee83fdb6cf659cf844273

    Score
    10/10
    formbookmodiloader3noppersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Formbook Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks