Overview

overview

10

Static

static

file8939928_89388.vbs

windows7_x64

10

file8939928_89388.vbs

windows10-2004_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file8939928_89388.vbs

  • Size

    162KB

  • Sample

    220131-pc7qwshfh5

  • MD5

    b889242d05699b592a96112125919adf

  • SHA1

    3d01fafa08dfdc3c3ad167f2a1c0cee1ac42f64a

  • SHA256

    f492e41de8e486bc3ee6e597232d0b80332252a2ccc24e33604836d6b1e3235c

  • SHA512

    0707c415f61e5cf581ad7b3dccddb8152ddde59b070a418817ce1201a2b48bfe5f19b192e1ec05d86c3bc55b21e663bd272a15830fb179ab1747fa9cafe20327

Score
10/10
formbookguloaderk6smdownloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

k6sm

Decoy

mingshengjewelry.com

ontimecleaningenterprise.com

alyssa0.xyz

ptecex.xyz

dukfot.online

pvcpc.com

iowalawtechnology.com

nestletranspotation.com

mysithomes.com

greenlakespaseattle.com

evofishingsystems.com

unilytcs.com

ordemt.com

dentalbatonrouge.com

pictureme360.net

chalinaslacatalana.com

newmirrorimage.xyz

pinklaceandlemonade.com

rapinantes.com

yzicpa.com

Targets

    • Target

      file8939928_89388.vbs

    • Size

      162KB

    • MD5

      b889242d05699b592a96112125919adf

    • SHA1

      3d01fafa08dfdc3c3ad167f2a1c0cee1ac42f64a

    • SHA256

      f492e41de8e486bc3ee6e597232d0b80332252a2ccc24e33604836d6b1e3235c

    • SHA512

      0707c415f61e5cf581ad7b3dccddb8152ddde59b070a418817ce1201a2b48bfe5f19b192e1ec05d86c3bc55b21e663bd272a15830fb179ab1747fa9cafe20327

    Score
    10/10
    formbookguloaderk6smdownloaderpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Formbook Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks