General

  • Target

    pos.gz

  • Size

    359KB

  • Sample

    211020-pc65cshhfm

  • MD5

    e273b01bade5ee7d1ebcee1643212397

  • SHA1

    15cc28fbd8232a12a08f8db74370e35cf123f630

  • SHA256

    614ff5c0107fc94f69cd80eacc9d3f70a36330d5cd369064f477b15823050898

  • SHA512

    65ffa9c4232475a529fb8d03e965b821bb2f2cc542bd849396f59f73bfd8826049062f2c5e7ccb68389f24a3f1334acc8edc9418321722e5e16cc5cdaccd16aa

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

u1bs

C2

http://www.vgmpradio.com/u1bs/

Decoy

ln-safe-keepingmisva4.xyz

rtfh.xyz

awolin.link

metadlf.com

cardboardcasual.com

psicoterapiahablada.com

spaminator.xyz

hnjqzl.top

dentalyinovasi.site

biosynblas.com

zvyk.store

shreevishwakarmaservices.com

showersplash.com

norbert-roth.com

londoncapitaltraders.com

istanbuldonerkebabheroncity.com

realdiscountsnow.com

marlinplumbingwnc.com

magazinadziavane.com

qantv.com

Targets

    • Target

      pos.exe

    • Size

      404KB

    • MD5

      6d626fa97d51af21b9856d7c0719ff7d

    • SHA1

      0c65de2146cfa001fcbc631f84fb0aad7f3ee3ed

    • SHA256

      429add11efba80f4e7d037b428d2dfc76e2c6904b5ff94ab0ccaa1fb4d665348

    • SHA512

      4964b60118d9049de1f87fcedddea4d32a176efb91b9bbf974832225b8a0fcfc5630a04bc6f45c31e8cb311f71497c1d14a38fd051d06dca03b19ee478b6f13a

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

System Information Discovery

1
T1082

Tasks