Overview

overview

10

Static

static

cc465d4d56...7c.exe

windows7_x64

10

cc465d4d56...7c.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6386876385230848.zip

  • Size

    373KB

  • Sample

    220127-wfww5agehn

  • MD5

    1c189b871abf4fe0df4420772d11add1

  • SHA1

    f01b2fbc0da579c23e171850ff13bbb53039ae9e

  • SHA256

    6496b359fec14328feb83ccae07d113476e9e382204c88b5829ba17f96ef2d02

  • SHA512

    784a69b9fa016c99e7d6abc15a2a446e09249bdc6577ddcabc8c2212e05122f0f392c109aaf6b32c145e1b4371371eed16b5ceb73494ee3e0c9726aa87cea85a

Score
10/10
formbookm8g9ratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m8g9

Decoy

jimmycamel.com

bestinvilnius.com

diana-jarvis.com

manabitown.net

luxuryremyhair.com

cavesage.com

wholequote.space

truckdrivingfuture.xyz

ptcouponspt.com

stainthree-shift.space

universalstaffingpros.com

alibi-music.com

iqjlylro.com

pinterestservice.com

soolehayeiran.com

youngplatformpro.com

fidelitysafesecure.com

af258.wine

theblissdynamic.com

aliciabrooksenglishmastiff.com

Targets

    • Target

      cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c

    • Size

      417KB

    • MD5

      37fb2bd58342a1c5f533a567da920b9f

    • SHA1

      cbf12b95467160f7d08654e6ffe08a3d560b0550

    • SHA256

      cc465d4d567ae58c8d25ff7d4e51c1b5c7b33e801517e3cf660e9a1c80e6f57c

    • SHA512

      1e7497780ec7a38ccf66ea1013e58cf0d396face9ad01c0fcc419deffa772ca5fbccbacdb02676892bfe27f7acc4df585363b300eefb2c7448a680a60d80c48e

    Score
    10/10
    formbookm8g9ratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks