Overview

overview

10

Static

static

5084c2d455...28.exe

windows7_x64

10

5084c2d455...28.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28

  • Size

    438KB

  • Sample

    220511-cyxftsdfa4

  • MD5

    7431c0da6bae8041862806106270065d

  • SHA1

    ae8611a9ec419855134f5c98999c64552029bfef

  • SHA256

    5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28

  • SHA512

    6838862dd49fcd22eb86e1475af170c94e2eea42dc3498c0e884132add9a835406729f1a678d33178a37a8b818d21e00a1cd5a1b4fe87df9e6eb2ca3273d3271

Score
10/10
formbookkvszratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kvsz

Decoy

hdlivesonlinetv24.com

illaheehillsseniorliving.com

wihong.com

christopher-cost.com

huayvipee.com

csdroped.xyz

relationsvivantes.com

xmcombohome.com

qingc2.com

sunsetcinemamusic.com

anotherheadache.com

connectlcv.com

unitermi.com

cugetarileunuisarman.com

agakegois.com

burnercouture.com

ambassador-holidays.com

schnarr-design.com

2013lang.com

httattoos.com

Targets

    • Target

      5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28

    • Size

      438KB

    • MD5

      7431c0da6bae8041862806106270065d

    • SHA1

      ae8611a9ec419855134f5c98999c64552029bfef

    • SHA256

      5084c2d455003df830c907939adc50ef250e7ccde99041e3f671202d1ec53c28

    • SHA512

      6838862dd49fcd22eb86e1475af170c94e2eea42dc3498c0e884132add9a835406729f1a678d33178a37a8b818d21e00a1cd5a1b4fe87df9e6eb2ca3273d3271

    Score
    10/10
    formbookkvszratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks