Overview

overview

10

Static

static

CONFIRM_.exe

windows7_x64

10

CONFIRM_.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7c4693347c14c9bca92ace69a3cc165269877791da5d19ab733f8b113f35ba0f

  • Size

    1.2MB

  • Sample

    220201-va45waaaa5

  • MD5

    98d4f177840484fbe15befc2e97f888c

  • SHA1

    b40e09949509a4ab38cbf058e3c52d7991a00c61

  • SHA256

    7c4693347c14c9bca92ace69a3cc165269877791da5d19ab733f8b113f35ba0f

  • SHA512

    b159e81d0fd4798f687db5cd7269190c14c5edce3da67abd1fe5d8191fec151edef08197dd5ea69a6728ac2224da7ca886c6883fc75bc29d2b2ac308deec34c5

Score
10/10
formbookergsratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ergs

Decoy

oceanprimesanfrancisco.com

dk-tnc.com

sodangwang.com

abrat-ed.com

dusubiqiqijem.xyz

getsup.online

homeneto.com

shose8.com

tronlane.com

nidowicosasod.xyz

independienteatleticclub.com

pca-winschool.com

realbadnastystories.site

bluevioletfloral.com

simplifiedpeacepodcast.com

abcfreediving.com

theyardbunny.com

holoique.com

ibkr1325.com

tjnfioou.xyz

Targets

    • Target

      CONFIRM_.EXE

    • Size

      417KB

    • MD5

      abb3147d8c0e9f65b3248004b8fffb91

    • SHA1

      127a10da0021ae217648b3636f38d84b8f1459f1

    • SHA256

      009e6b48b7d9b2a802d6e831138b1e55c4390861c123287e134bbc21f8a6e225

    • SHA512

      af55e007019139a2257815f50f4e1de3fbc6e1fc9195104c989dc6935bc3ec494c2a5900fb56d13fcf1c1a9043659e9c77a7af37b17aec63d9c59a88b9efed02

    Score
    10/10
    formbookergsratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks