Overview

overview

10

Static

static

orden de compra.exe

windows7_x64

10

orden de compra.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f8594f486bb2feba0aac43986145d67e30a9280ae4a6a06ca1175d83099d286

  • Size

    334KB

  • Sample

    220520-2fmaksfcc3

  • MD5

    bbcff5c893694167a63789ab94c029f0

  • SHA1

    ee194ed86c30a37822e90fd695d38545ff22b69b

  • SHA256

    6f8594f486bb2feba0aac43986145d67e30a9280ae4a6a06ca1175d83099d286

  • SHA512

    745994bd256aad70efa180dccc59905c8fb39f3644bc42742a3f3de0377e03373679654bd4bbb4b1224764786d78cdedd8dfd48dd3cabbf88aa83d5b31be9074

Score
10/10
formbookkvszpersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kvsz

Decoy

okashyns.com

sbsgamedaejeon-two.com

drb77.com

top5dating.com

websprings.online

voizers.com

zenith.site

lahistoriade.com

qv85.com

armandonieto.com

priestvedic.com

jessandjeff.net

magic-desktop.com

jitaji.com

ldmeili.com

yuwanqingmy.com

buzhouorg.com

chaiseloungereviews.com

m2g8way.com

freespin-support.com

Targets

    • Target

      orden de compra.exe

    • Size

      380KB

    • MD5

      2a30abd4d6db32bfc49a069c56ceb45c

    • SHA1

      dc1411169ccfac189b4370ce8342779051a65753

    • SHA256

      2f9d83d844287396dcaf52b5c15c1dacc92bc4ae2e2777d24c8d09465037ace3

    • SHA512

      fa5110812d55c02e597b4ec890b6f40bcb23e66ecb79189f4d0e461cb87c40f4fb3a36cf6f3edf47b9c4ab9b784702751338399a5cfe14e9bd31ba3b8917403f

    Score
    10/10
    formbookkvszratspywarestealertrojanpersistencesuricata

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks