Overview

overview

10

Static

static

1

rro4126.exe

windows7_x64

10

rro4126.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rro4126.exe

  • Size

    256KB

  • Sample

    211011-n87v4ahbem

  • MD5

    734e49a5eb9193a08ab2a1f66c4ec254

  • SHA1

    bc1004564de46d39269e7c844d1094f869c988d8

  • SHA256

    c12bd972fbf3301e40fa75c3e295a8bd0233bf1f5fa100e79ab7f6755f7b6788

  • SHA512

    89c4a188c143ba5d9a636f733b475ba9e67aae287cb36f26b471d0fed29a46ba8b1f9032358c22eeee8463c3667eb5d054c822aaa5a6f4d91b47bfd19e558f38

Score
10/10
formbookrv9nratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rv9n

C2

http://www.cjspizza.net/rv9n/

Decoy

olivia-grace.show

zhuwww.com

keiretsu.xyz

olidnh.space

searuleansec.com

2fastrepair.com

brooklynmetalroof.com

scodol.com

novaprint.pro

the-loaner.com

nextroundscap.com

zbwlggs.com

internetautodealer.com

xn--tornrealestate-ekb.com

yunjiuhuo.com

skandinaviskakryptobanken.com

coxivarag.rest

ophthalmologylab.com

zzzzgjcdbqnn98.net

doeful.com

Targets

    • Target

      rro4126.exe

    • Size

      256KB

    • MD5

      734e49a5eb9193a08ab2a1f66c4ec254

    • SHA1

      bc1004564de46d39269e7c844d1094f869c988d8

    • SHA256

      c12bd972fbf3301e40fa75c3e295a8bd0233bf1f5fa100e79ab7f6755f7b6788

    • SHA512

      89c4a188c143ba5d9a636f733b475ba9e67aae287cb36f26b471d0fed29a46ba8b1f9032358c22eeee8463c3667eb5d054c822aaa5a6f4d91b47bfd19e558f38

    Score
    10/10
    formbookrv9nratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks