Overview

overview

10

Static

static

#PO##56785...PY.exe

windows7_x64

10

#PO##56785...PY.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bfcaedd79e990385731eb5f9002f6fc719ec6f2e51749765f4f2593ebcab9aef

  • Size

    269KB

  • Sample

    220521-n1nggsedf2

  • MD5

    4983a26814862a94b7671274c33df5b6

  • SHA1

    a4340aa6060fa91c4310d930c033fd22ab1b8b9c

  • SHA256

    bfcaedd79e990385731eb5f9002f6fc719ec6f2e51749765f4f2593ebcab9aef

  • SHA512

    b671efe9ef3c02ce53ba06e1a5ccf2f68de4b043f7d8423551656a1f06e00a7ff11146ac3cb28dbcaa14954fb5a57f4a06ac4fe5d46de2eb268fb7a65fdd6544

Score
10/10
formbooktnkpersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

tnk

Decoy

lafioletto.com

mgiuj.com

wolllafvixzies.win

wwwsbvip123.com

nadyaasnae.com

noticesinvoice2017.com

intercapati.com

tg8895.com

9245654874.com

lytsxc.info

rffuf3-liquidwebsites.com

verguet.com

peinturefleursetfemmes.com

xttmrama.com

cryptoinvestmentideas.com

kikumasacarparts.win

freeapk1.com

tasteofimagination.com

gxzyoa.com

cq-mingwei.com

Targets

    • Target

      #PO##5678543278...COPY.exe

    • Size

      302KB

    • MD5

      7a3750d52e2491d0360ec5e3cf5f0b1f

    • SHA1

      21a8a81928261c01ce481a14d623663eef5bf2ba

    • SHA256

      430632994b3bcc69911202aa595375009e84accb95b00917bde643fcf031fa4d

    • SHA512

      099dc4fe67a0ef50459a9f137f41eb78bd6b01cdeec9f8f524fd8476346a132ed4bda5b471e87e5a8be90fbb0ff78d2b7c7d9da25340c2d3d1468d1a46ae1387

    Score
    10/10
    formbooktnkpersistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata: ET MALWARE FormBook CnC Checkin (POST) M2

      suricata

    • Formbook Payload

      rat

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks