Overview

overview

10

Static

static

1

yutrre123.exe

windows7_x64

10

yutrre123.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    yutrre123.exe

  • Size

    254KB

  • Sample

    211008-sga49sefeq

  • MD5

    7f0a0bc19a6da99c8ab7f8f77a1a6a59

  • SHA1

    0d961900905b134eca222792806e63bd7a43cfa3

  • SHA256

    f840ca48e6381b385534156b8245c39dee4d1c95e18569c91b5537ff2f20aa7d

  • SHA512

    59a7274d661cc22fff771a5e2c2eb6bf04fdf4caa9d70a034e15bbdc0b5071d3c769ab0967c705bc457c78e6a1d11f6b6f8a7a34282b48c0bdd6d3723e3485a4

Score
10/10
formbookrv9nratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rv9n

C2

http://www.cjspizza.net/rv9n/

Decoy

olivia-grace.show

zhuwww.com

keiretsu.xyz

olidnh.space

searuleansec.com

2fastrepair.com

brooklynmetalroof.com

scodol.com

novaprint.pro

the-loaner.com

nextroundscap.com

zbwlggs.com

internetautodealer.com

xn--tornrealestate-ekb.com

yunjiuhuo.com

skandinaviskakryptobanken.com

coxivarag.rest

ophthalmologylab.com

zzzzgjcdbqnn98.net

doeful.com

Targets

    • Target

      yutrre123.exe

    • Size

      254KB

    • MD5

      7f0a0bc19a6da99c8ab7f8f77a1a6a59

    • SHA1

      0d961900905b134eca222792806e63bd7a43cfa3

    • SHA256

      f840ca48e6381b385534156b8245c39dee4d1c95e18569c91b5537ff2f20aa7d

    • SHA512

      59a7274d661cc22fff771a5e2c2eb6bf04fdf4caa9d70a034e15bbdc0b5071d3c769ab0967c705bc457c78e6a1d11f6b6f8a7a34282b48c0bdd6d3723e3485a4

    Score
    10/10
    formbookrv9nratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks