Overview

overview

10

Static

static

CC2107139144.exe

windows7_x64

10

CC2107139144.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CC2107139144.exe

  • Size

    856KB

  • Sample

    220125-l3yzwsdgf8

  • MD5

    51beaa7443a361691a0cbef6e56d890b

  • SHA1

    5a851452118c729d94b99f83c85cd819f5f96de6

  • SHA256

    bdfb763b51cd4a618ad0d10388f1f478d1acddc7917891a990e8f390c9319b76

  • SHA512

    2f41652699b858e31182ad7c14593034c75c78929ce24ab1ec65cf62f800cc04e0c64acc08a3e4c3d28d5d38769a829d38ce4fa684ed89f384ca663bb1b4a440

Score
10/10
formbookv32sratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

v32s

Decoy

water-hada-utsukushii.xyz

9v6v.com

rechtsanwalt-trnka.com

lets-eat-healthy.com

vannyscreamycreations.com

cosy-bamboo.com

leedexamtraining.com

lilbusinessowner.com

cncvietnam.net

gpsplayback.com

aroidaddictfl.com

patienpower.info

777londonescorts.com

whrpky078.xyz

yqamuh.com

virtualft.com

fanfanway.com

56789r.com

926397.com

kp-crane.com

Targets

    • Target

      CC2107139144.exe

    • Size

      856KB

    • MD5

      51beaa7443a361691a0cbef6e56d890b

    • SHA1

      5a851452118c729d94b99f83c85cd819f5f96de6

    • SHA256

      bdfb763b51cd4a618ad0d10388f1f478d1acddc7917891a990e8f390c9319b76

    • SHA512

      2f41652699b858e31182ad7c14593034c75c78929ce24ab1ec65cf62f800cc04e0c64acc08a3e4c3d28d5d38769a829d38ce4fa684ed89f384ca663bb1b4a440

    Score
    10/10
    formbookv32sratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks