Overview

overview

10

Static

static

Document R...21.exe

windows7_x64

10

Document R...21.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Document RFQ#8086A_461A_0000086_300_3550_2021.exe

  • Size

    510KB

  • Sample

    211019-hc1h9agcal

  • MD5

    a445dd187c6dc7254da6d2f0d893f2fb

  • SHA1

    c0548d4ed4a9c2b68fbcf592e9a892fa587d5b0e

  • SHA256

    2a2187ae775f286c2400957b71aac1c550779fc6652a710d126546d4d4879f0f

  • SHA512

    ec8fb387474fe1a737ea46d67e5b2e363ecb6c35634e1af63e465fb487c8ae2b7684d128d8ea982d6234110dee83a4601b6fba64f05765a41927f580520c527e

Score
10/10
formbookg8niratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g8ni

C2

http://www.er5544.com/g8ni/

Decoy

nickmowat.com

garethjame.biz

colibrilift.com

vulnerabilitylabs.one

neuro-ai-web-ru.website

16mcnaestreetmooneeponds.com

bestofstmaarten.net

meditelier.com

ragnarduke.com

escueladecampo.com

vongtayvn.com

inmemoriamaan.com

yourpeoplemanager.com

r6-gytr.com

agreeablebeauty.com

snpconfirms.com

tribalurq.quest

purafuse.com

cisco-training-course.com

wery.top

Targets

    • Target

      Document RFQ#8086A_461A_0000086_300_3550_2021.exe

    • Size

      510KB

    • MD5

      a445dd187c6dc7254da6d2f0d893f2fb

    • SHA1

      c0548d4ed4a9c2b68fbcf592e9a892fa587d5b0e

    • SHA256

      2a2187ae775f286c2400957b71aac1c550779fc6652a710d126546d4d4879f0f

    • SHA512

      ec8fb387474fe1a737ea46d67e5b2e363ecb6c35634e1af63e465fb487c8ae2b7684d128d8ea982d6234110dee83a4601b6fba64f05765a41927f580520c527e

    Score
    10/10
    formbookg8niratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks