Overview

overview

10

Static

static

ypBNBVznebkl.exe

windows7_x64

10

ypBNBVznebkl.exe

windows10-2004_x64

1

Resubmissions

04-02-2022 14:47

220204-r6ctqabcd8 10

04-02-2022 14:44

220204-r4fgtsbdcl 1

04-02-2022 14:31

220204-rvw38abcam 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    malware.zip

  • Size

    443KB

  • Sample

    220204-rvw38abcam

  • MD5

    5d9579ace11444ace785f4a3785107a9

  • SHA1

    6286a6b1188e280a893509da9346ddd121ba2bfd

  • SHA256

    90eb875442a3173e54855155d12d4017bdca808160ed138552615ff0c0160e1a

  • SHA512

    9777650b5d32c8d00d9c43454db6dec2555f8aa205c27299baaad2f4bf49f345193e54336c402ec37b7c42a79ccda9a455fe231762d7f2f32007c7402aa38c08

Score
10/10
formbookg2m3ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g2m3

Decoy

stocktonfingerprinting.com

metaaiqr.com

junicy.com

libertymutualgrou.com

jklhs7gl.xyz

alex-covalcova.space

socialfiguild.com

drnicholasreid.com

androidappprogrammierie.com

relatingtohumans.com

jitsystems.com

gbwpmz.com

lesaventuresdecocomango.com

wu8ggqdv077p.xyz

autnvg.com

wghakt016.xyz

lagosian.store

hilldoor.com

oculos-ajustavel-br.xyz

nameniboothac.com

Targets

    • Target

      ypBNBVznebkl.exe

    • Size

      590KB

    • MD5

      ca8fd7f239f0b32c15261766b4134de0

    • SHA1

      7902a3d808b13b7bbb16cf6a711b5c12abf735b2

    • SHA256

      17299141dd71b72d2aa0250a478b4d3295ecd09b575232463ecf592cadda19b5

    • SHA512

      0982ccce0d0dadf9573f15db9fa861695eacfd9b05741fe3698f2ecf4c46d9133545228718f631bd6d2c2a3025199ccda08cf28b33a047b2ad34e9220c2d71c1

    Score
    10/10
    formbookg2m3ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks