Overview

overview

10

Static

static

conferma S...df.exe

windows7_x64

10

conferma S...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    conferma SWIFT copia pdf.exe.xz

  • Size

    239KB

  • Sample

    210920-m6tp1sgdgj

  • MD5

    b1a0373d85ce8dd67441d5f3f56b459c

  • SHA1

    339059ce58a47125b9969a6450409d370fd62bc4

  • SHA256

    40fc68d7efeb6585b14073cec45be4b4d514a97beb1d23f5bc54610c56a9aab6

  • SHA512

    dac480af4a8630a4a8bdef037d20ed3b63d6d50b006403a1511266cbaa213384d34c99034a7f1f0303764c7aa0ebc6617436dcde2291a07c4a9a04c2a83605c9

Score
10/10
formbookn7akratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n7ak

C2

http://www.kmresults.com/n7ak/

Decoy

modischoolcbse.com

theneverwinter.com

rszkjx-vps-hosting.website

fnihil.com

1pbet.com

nnowzscorrez.com

uaotgvjl.icu

starmapsqatar.com

ekisilani.com

extradeepsheets.com

jam-nins.com

buranly.com

orixentertainment.com

rawtech.energy

myol.guru

utex.club

jiapie.com

wowig.store

wweidlyyl.com

systaskautomation.com

Targets

    • Target

      conferma SWIFT copia pdf.exe

    • Size

      684KB

    • MD5

      8371b3f4f53c2f7d2ac7fbc66719660b

    • SHA1

      762d5507ae4c64ae0dc11098ea1f1ce5a5d8d28d

    • SHA256

      a3da5c70fbe1fabaaec65ce52c8e76384e94a5937e9fd7e8515ba8a1a048b255

    • SHA512

      b54474caee9cbed9910156e35a8b6b0ee6723971777e2c010d734637e42f104562b57609b20aadee66591d8d97f165d848260262c8e0d3118b3e44efbdf9ebe3

    Score
    10/10
    formbookn7akratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks