Overview

overview

10

Static

static

9

PG2005005.exe

windows7_x64

10

PG2005005.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca44d4aadf6c7f4120ab51143b5d05a46737ad470cf593c372901ca0f0ee2b2f

  • Size

    354KB

  • Sample

    220521-n9ewpsehb2

  • MD5

    fd2402999d516ef1ae4037db15d7f75a

  • SHA1

    934bb6a6460644ccf60766b6b048b54ff735be90

  • SHA256

    ca44d4aadf6c7f4120ab51143b5d05a46737ad470cf593c372901ca0f0ee2b2f

  • SHA512

    bc9639051edef312944ddf9327655254f3fc7b7dae7b09d936aa56b5d0076a0065224431bb0eef417c3d117285e5ddf87b63c8d8b357a553248a2050b5e3fada

Score
10/10
formbookev08persistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

ev08

Decoy

elysianhomesanddesign.com

emplytics.com

rx-server.com

yunkeguanjia.com

069xke.info

xgltnpzoai.biz

vizebasvurusuislemi.com

willenochhardscape.com

luciovicencio.com

369zhangting.com

dealsamzn.com

epsilontech.net

longzhimy.com

drfenxiyi.com

perfecttiger.win

jon-lisa.com

projeen.com

tpak4.com

telurasinjulak.com

grhcew.men

Targets

    • Target

      PG2005005.exe

    • Size

      389KB

    • MD5

      3316029db1ea9e093aeb24566210e240

    • SHA1

      a1dbdaa76bbc5d0617d3ac44074424316c8a5af9

    • SHA256

      2ed611befc2af97a0bf7bada7f7b53d4f625f99620983252455e675d22021bc6

    • SHA512

      28403a94f04b50b3c3304306706385fd573e4106a15f7d0a8f03663ae96de63f055dabb2d43823ea73297bd3df34435719326e635f110ccd6377b48efc67cc42

    Score
    10/10
    formbookev08ratspywarestealertrojanpersistencesuricata

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks