Overview

overview

10

Static

static

List of ou...er.exe

windows7_x64

10

List of ou...er.exe

windows10-2004_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa727bc89057fa9b33dbf9a20c1d0800146f05a28bbad527ed2a836c2fa4e2d3

  • Size

    324KB

  • Sample

    220521-ntwjhsebc5

  • MD5

    c2cdc3dba69f5f5eb6f75ec52fbfcb79

  • SHA1

    52de4fd06cf85232fa909fee03107e26a25349e3

  • SHA256

    fa727bc89057fa9b33dbf9a20c1d0800146f05a28bbad527ed2a836c2fa4e2d3

  • SHA512

    287808dee129c6c6c48e9f7bea9111882926cd2db78f92588d4d6bf43f535c37432d8ce2b71a994443627794296a9a825c31cfdb290741a89426e58c3a24280d

Score
10/10
formbook3noppersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nop

Decoy

bakecakesandmore.com

shenglisuoye.com

chinapopfactory.com

ynlrhd.com

liqourforyou.com

leonqamil.com

meccafon.com

online-marketing-strategie.biz

rbfxi.com

frseyb.info

leyu91.com

hotsmail.today

beepot.tech

dunaemmetmobility.com

sixpenceworkshop.com

incrediblefavorcoaching.com

pofo.info

yanshudaili.com

yellowbrickwedding.com

paintpartyblueprint.com

Targets

    • Target

      List of our purchase order.exe

    • Size

      1.1MB

    • MD5

      94c591351a9f0c0e8c61ee32b1e4bed8

    • SHA1

      37c19b86622d1a9725a87c288af816aadda575a2

    • SHA256

      017f433a49afcc765c5a5e7f39de6251fbe37d9c98f7d86f1abcefb1a9f559bc

    • SHA512

      1b768f633f2d748a59a967f767eec9300e467163fc907b65c4b520c538bfeb89b7f957a566b365bce813ef9d47eb6e1372e3451b4527a62e37e9dcd30f4c0241

    Score
    10/10
    formbook3noppersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks