Overview

overview

10

Static

static

0026011021.exe

windows7_x64

10

0026011021.exe

windows10_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0026011021.exe

  • Size

    496KB

  • Sample

    211126-qrty1sfhc5

  • MD5

    25348a9ed8b5714857ca9d90b6346c06

  • SHA1

    2409b3aa6d381cf4f2e638e133344d5a29b4a65b

  • SHA256

    3f329c3c43a80af4145116889d380b5022d7509b18a36143d3adf455d71ad02f

  • SHA512

    76fccd5292c2ec5a5d9f0bb17874d71fe00d3b3495df06026073692b81da4c884fd97f8f965517f3f8abb9f0dfa83b9e44054f1997fa3d931768331c7f39765a

Score
10/10
formbooku1bsratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

u1bs

C2

http://www.vgmpradio.com/u1bs/

Decoy

ln-safe-keepingmisva4.xyz

rtfh.xyz

awolin.link

metadlf.com

cardboardcasual.com

psicoterapiahablada.com

spaminator.xyz

hnjqzl.top

dentalyinovasi.site

biosynblas.com

zvyk.store

shreevishwakarmaservices.com

showersplash.com

norbert-roth.com

londoncapitaltraders.com

istanbuldonerkebabheroncity.com

realdiscountsnow.com

marlinplumbingwnc.com

magazinadziavane.com

qantv.com

Targets

    • Target

      0026011021.exe

    • Size

      496KB

    • MD5

      25348a9ed8b5714857ca9d90b6346c06

    • SHA1

      2409b3aa6d381cf4f2e638e133344d5a29b4a65b

    • SHA256

      3f329c3c43a80af4145116889d380b5022d7509b18a36143d3adf455d71ad02f

    • SHA512

      76fccd5292c2ec5a5d9f0bb17874d71fe00d3b3495df06026073692b81da4c884fd97f8f965517f3f8abb9f0dfa83b9e44054f1997fa3d931768331c7f39765a

    Score
    10/10
    formbooku1bsratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks