Overview

overview

10

Static

static

pos.exe

windows7_x64

10

pos.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pos.exe

  • Size

    404KB

  • Sample

    211020-pc65cshad5

  • MD5

    6d626fa97d51af21b9856d7c0719ff7d

  • SHA1

    0c65de2146cfa001fcbc631f84fb0aad7f3ee3ed

  • SHA256

    429add11efba80f4e7d037b428d2dfc76e2c6904b5ff94ab0ccaa1fb4d665348

  • SHA512

    4964b60118d9049de1f87fcedddea4d32a176efb91b9bbf974832225b8a0fcfc5630a04bc6f45c31e8cb311f71497c1d14a38fd051d06dca03b19ee478b6f13a

Score
10/10
formbooku1bsratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

u1bs

C2

http://www.vgmpradio.com/u1bs/

Decoy

ln-safe-keepingmisva4.xyz

rtfh.xyz

awolin.link

metadlf.com

cardboardcasual.com

psicoterapiahablada.com

spaminator.xyz

hnjqzl.top

dentalyinovasi.site

biosynblas.com

zvyk.store

shreevishwakarmaservices.com

showersplash.com

norbert-roth.com

londoncapitaltraders.com

istanbuldonerkebabheroncity.com

realdiscountsnow.com

marlinplumbingwnc.com

magazinadziavane.com

qantv.com

Targets

    • Target

      pos.exe

    • Size

      404KB

    • MD5

      6d626fa97d51af21b9856d7c0719ff7d

    • SHA1

      0c65de2146cfa001fcbc631f84fb0aad7f3ee3ed

    • SHA256

      429add11efba80f4e7d037b428d2dfc76e2c6904b5ff94ab0ccaa1fb4d665348

    • SHA512

      4964b60118d9049de1f87fcedddea4d32a176efb91b9bbf974832225b8a0fcfc5630a04bc6f45c31e8cb311f71497c1d14a38fd051d06dca03b19ee478b6f13a

    Score
    10/10
    formbooku1bsratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks