Overview

overview

10

Static

static

PI Confirmation.exe

windows7_x64

10

PI Confirmation.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cfd85f7690b503154bad4aed263e953b0b5da84cd8dc8eaa0b99302be53f36d9

  • Size

    306KB

  • Sample

    220521-ntbt4shbgq

  • MD5

    0c21dacbb9b71985dfb7c8b81c631141

  • SHA1

    7a7f0aa9689232fca86562f77f08b9e1b07db3cc

  • SHA256

    cfd85f7690b503154bad4aed263e953b0b5da84cd8dc8eaa0b99302be53f36d9

  • SHA512

    007e1560ec6aed90707d10dab06b0ba49f388691b95c0db600e09fb053f34794b47f8c26f293611091f227b2628c5f511eb69a11833964592ef95cb283358478

Score
10/10
formbookev08persistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

ev08

Decoy

elysianhomesanddesign.com

emplytics.com

rx-server.com

yunkeguanjia.com

069xke.info

xgltnpzoai.biz

vizebasvurusuislemi.com

willenochhardscape.com

luciovicencio.com

369zhangting.com

dealsamzn.com

epsilontech.net

longzhimy.com

drfenxiyi.com

perfecttiger.win

jon-lisa.com

projeen.com

tpak4.com

telurasinjulak.com

grhcew.men

Targets

    • Target

      PI Confirmation.exe

    • Size

      669KB

    • MD5

      39c13f82ae8a3803684959e14772c5b0

    • SHA1

      5284c7308994dbe3348c320499c3756aeae50f1d

    • SHA256

      f4c535616a04819e9553cb3dbac66db0021065fb89a5e5c799c0b4eb301fb582

    • SHA512

      55f7bfbf2cf916bee80d51827fbb8394f97c2fee12c2ea060b52e06b51c996c43bd4475dae7464cce71915e14ed7151dbee23252fb2e6f4046542488d68cf442

    Score
    10/10
    formbookev08persistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks