Overview

overview

10

Static

static

pos.exe

windows7_x64

10

pos.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pos.exe

  • Size

    674KB

  • Sample

    211024-lda7jaefam

  • MD5

    397f77e9fa4a64173bdb4e97b2eca2f2

  • SHA1

    9e1f131229b2c427f14c4480ae4963ac089e03d5

  • SHA256

    4850acfdb42686e44bef0aaaffa11dbffe1d59db4a84def2e12a309ab09561c5

  • SHA512

    664bf4425ca4e24b48b6a369daf7af613cd94ce98382b580540022796a03c15f6fd0a6803a4c09f670f0c115a64692e42defd8e467bb048530dfad771a1e4a31

Score
10/10
formbooku1bsratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

u1bs

C2

http://www.vgmpradio.com/u1bs/

Decoy

ln-safe-keepingmisva4.xyz

rtfh.xyz

awolin.link

metadlf.com

cardboardcasual.com

psicoterapiahablada.com

spaminator.xyz

hnjqzl.top

dentalyinovasi.site

biosynblas.com

zvyk.store

shreevishwakarmaservices.com

showersplash.com

norbert-roth.com

londoncapitaltraders.com

istanbuldonerkebabheroncity.com

realdiscountsnow.com

marlinplumbingwnc.com

magazinadziavane.com

qantv.com

Targets

    • Target

      pos.exe

    • Size

      674KB

    • MD5

      397f77e9fa4a64173bdb4e97b2eca2f2

    • SHA1

      9e1f131229b2c427f14c4480ae4963ac089e03d5

    • SHA256

      4850acfdb42686e44bef0aaaffa11dbffe1d59db4a84def2e12a309ab09561c5

    • SHA512

      664bf4425ca4e24b48b6a369daf7af613cd94ce98382b580540022796a03c15f6fd0a6803a4c09f670f0c115a64692e42defd8e467bb048530dfad771a1e4a31

    Score
    10/10
    formbooku1bsratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks