Overview

overview

10

Static

static

1

bnmf4567.exe

windows7_x64

10

bnmf4567.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bnmf4567.exe

  • Size

    247KB

  • Sample

    211027-qv9hwaehc2

  • MD5

    7d3aa18f0f3532613b0fc9ebcc15a1c8

  • SHA1

    a40e3a28ba8881472ab2eef4ce6a949533e351d8

  • SHA256

    0a52be6a293fd6f0698df151dcae0ab8a5ec48d4b9189d1bf1ae84f052d3c236

  • SHA512

    0b70d93d4485034f7a4e27594ab5db2e414b9aff302d9c68a8793d3d0a6e3d3361856a79ca1723f36a4c469cc6f4f273f2342a5748fda8923777ff67de03bb14

Score
10/10
formbookrv9nratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rv9n

C2

http://www.cjspizza.net/rv9n/

Decoy

olivia-grace.show

zhuwww.com

keiretsu.xyz

olidnh.space

searuleansec.com

2fastrepair.com

brooklynmetalroof.com

scodol.com

novaprint.pro

the-loaner.com

nextroundscap.com

zbwlggs.com

internetautodealer.com

xn--tornrealestate-ekb.com

yunjiuhuo.com

skandinaviskakryptobanken.com

coxivarag.rest

ophthalmologylab.com

zzzzgjcdbqnn98.net

doeful.com

Targets

    • Target

      bnmf4567.exe

    • Size

      247KB

    • MD5

      7d3aa18f0f3532613b0fc9ebcc15a1c8

    • SHA1

      a40e3a28ba8881472ab2eef4ce6a949533e351d8

    • SHA256

      0a52be6a293fd6f0698df151dcae0ab8a5ec48d4b9189d1bf1ae84f052d3c236

    • SHA512

      0b70d93d4485034f7a4e27594ab5db2e414b9aff302d9c68a8793d3d0a6e3d3361856a79ca1723f36a4c469cc6f4f273f2342a5748fda8923777ff67de03bb14

    Score
    10/10
    formbookrv9nratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks