Overview

overview

10

Static

static

1

fvbgr12345.exe

windows7_x64

10

fvbgr12345.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fvbgr12345.exe

  • Size

    253KB

  • Sample

    211001-vnlwfscgb7

  • MD5

    98bea37f0a2af4ef402f7d126ffae77c

  • SHA1

    59c3a8c1014adcea29cd83480e4e5168f8b6ab3b

  • SHA256

    7249d67d49a862e577120d3125e33566c61241969b4f48d701de97a5fe0abc04

  • SHA512

    01ace3811524ebb50fe6259104c8e4d0e4feabf409fe5cca9a29cbe66691a32c56de5d8d79d14ba4ba42189fcd6b8e8b73675e3cafa1fdd027c0afd8cfe033ae

Score
10/10
formbookrv9nratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rv9n

C2

http://www.cjspizza.net/rv9n/

Decoy

olivia-grace.show

zhuwww.com

keiretsu.xyz

olidnh.space

searuleansec.com

2fastrepair.com

brooklynmetalroof.com

scodol.com

novaprint.pro

the-loaner.com

nextroundscap.com

zbwlggs.com

internetautodealer.com

xn--tornrealestate-ekb.com

yunjiuhuo.com

skandinaviskakryptobanken.com

coxivarag.rest

ophthalmologylab.com

zzzzgjcdbqnn98.net

doeful.com

Targets

    • Target

      fvbgr12345.exe

    • Size

      253KB

    • MD5

      98bea37f0a2af4ef402f7d126ffae77c

    • SHA1

      59c3a8c1014adcea29cd83480e4e5168f8b6ab3b

    • SHA256

      7249d67d49a862e577120d3125e33566c61241969b4f48d701de97a5fe0abc04

    • SHA512

      01ace3811524ebb50fe6259104c8e4d0e4feabf409fe5cca9a29cbe66691a32c56de5d8d79d14ba4ba42189fcd6b8e8b73675e3cafa1fdd027c0afd8cfe033ae

    Score
    10/10
    formbookrv9nratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks