Overview

overview

10

Static

static

1

yutrre123.exe

windows7_x64

10

yutrre123.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BC_28049.cab

  • Size

    240KB

  • Sample

    211008-3hj4nsehd7

  • MD5

    e4b3971d6ef769736a8caccc3812d29a

  • SHA1

    83f352cfaeb82bbe5a32359bb130b42dbb15c892

  • SHA256

    114c6e63e0398ea05b560df69e0fbb55e2393750d8aa0b1c0c2730bb9d048ebd

  • SHA512

    073387c40a2c881b1015300c4c2241fae21e5d3996dd8cebb67903655c50d43dec65364187dfe743063e8ccb6166f5781cfc573866e3a79a05d384744f241659

Score
10/10
formbookrv9nratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rv9n

C2

http://www.cjspizza.net/rv9n/

Decoy

olivia-grace.show

zhuwww.com

keiretsu.xyz

olidnh.space

searuleansec.com

2fastrepair.com

brooklynmetalroof.com

scodol.com

novaprint.pro

the-loaner.com

nextroundscap.com

zbwlggs.com

internetautodealer.com

xn--tornrealestate-ekb.com

yunjiuhuo.com

skandinaviskakryptobanken.com

coxivarag.rest

ophthalmologylab.com

zzzzgjcdbqnn98.net

doeful.com

Targets

    • Target

      yutrre123.exe

    • Size

      254KB

    • MD5

      7f0a0bc19a6da99c8ab7f8f77a1a6a59

    • SHA1

      0d961900905b134eca222792806e63bd7a43cfa3

    • SHA256

      f840ca48e6381b385534156b8245c39dee4d1c95e18569c91b5537ff2f20aa7d

    • SHA512

      59a7274d661cc22fff771a5e2c2eb6bf04fdf4caa9d70a034e15bbdc0b5071d3c769ab0967c705bc457c78e6a1d11f6b6f8a7a34282b48c0bdd6d3723e3485a4

    Score
    10/10
    formbookrv9nratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks