Overview

overview

10

Static

static

Energypac ...td.rtf

windows7_x64

10

Energypac ...td.rtf

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Energypac Pty. Ltd.doc

  • Size

    11KB

  • Sample

    220202-jbtvrahdek

  • MD5

    d3fe6624b0f044affcbd0ef54f646ec8

  • SHA1

    2df87a6549c40d6492548e91180c417849557b8d

  • SHA256

    fe17e03a00c4aee4bb8daa8507c1b9bc88a28f3f7c53f10f064a8dbbe7b3dc96

  • SHA512

    5697394a1c40866fcfef79591f31247997f867942ee63553d892ad23f5928a429e133d2490f774acbd9580391071f53933f5833955a8dccf2a98a20462196b04

Score
10/10
formbookcw22ratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cw22

Decoy

betvoy206.com

nftstoners.com

tirupatibuilder.com

gulldesigns.com

shemhq.com

boricosmetic.com

bitcoinbillionaireboy.com

theflypaperplanes.com

retrocartours.com

yangzhie326.com

cheepchain.com

sentryr.com

luckirentalhomes.com

pointssquashers.com

dianasarabiantreasures.com

calendarsilo.com

sublike21.xyz

gajubg0up.xyz

lousfoodreviews.com

fades.site

Targets

    • Target

      Energypac Pty. Ltd.doc

    • Size

      11KB

    • MD5

      d3fe6624b0f044affcbd0ef54f646ec8

    • SHA1

      2df87a6549c40d6492548e91180c417849557b8d

    • SHA256

      fe17e03a00c4aee4bb8daa8507c1b9bc88a28f3f7c53f10f064a8dbbe7b3dc96

    • SHA512

      5697394a1c40866fcfef79591f31247997f867942ee63553d892ad23f5928a429e133d2490f774acbd9580391071f53933f5833955a8dccf2a98a20462196b04

    Score
    10/10
    formbookcw22ratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks