Overview

overview

10

Static

static

BANK SLIP.exe

windows7_x64

10

BANK SLIP.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BANK SLIP.exe

  • Size

    464KB

  • Sample

    211103-rb89fadhh6

  • MD5

    b94efb11bb057e324e00967a077a9c3f

  • SHA1

    a96358b10168fce176481019f26e9d331c03ee57

  • SHA256

    93570be59d8c3f3608ffe0b137503c6555e6f40514af2c22989fe61a2394ecd5

  • SHA512

    2f968024ee4d1e9a46cf4067d467cc37e0ea4967060b09d2b59410670bac907d18fbb6fa757b44abe7978edeadb9bb19d8621c95cb6b9740edceca35a5043685

Score
10/10
formbookr4gkratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

r4gk

C2

http://www.aprilsaak.quest/r4gk/

Decoy

quantalix.com

animalblog-eggs.com

039skz.xyz

guttas.net

lasantadayparty.com

protegerfinanceservices.com

vixtest.xyz

digitaleconomy.global

0xpax.xyz

mobilehome1688.com

themotionpartners.com

valueney.com

hattuafhv.quest

js0061gj.net

360metaverse.biz

seculardata.com

346727688.xyz

smartmapom.com

moksel.com

exoduswatchco.com

Targets

    • Target

      BANK SLIP.exe

    • Size

      464KB

    • MD5

      b94efb11bb057e324e00967a077a9c3f

    • SHA1

      a96358b10168fce176481019f26e9d331c03ee57

    • SHA256

      93570be59d8c3f3608ffe0b137503c6555e6f40514af2c22989fe61a2394ecd5

    • SHA512

      2f968024ee4d1e9a46cf4067d467cc37e0ea4967060b09d2b59410670bac907d18fbb6fa757b44abe7978edeadb9bb19d8621c95cb6b9740edceca35a5043685

    Score
    10/10
    formbookr4gkratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks