Overview

overview

10

Static

static

SwiftLCCM....f..exe

windows7_x64

10

SwiftLCCM....f..exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2459438d8963402c140cc0cef2e8b755e85f8c1dee781c077f3171a9fbc19b6e

  • Size

    258KB

  • Sample

    220521-pygftsgbg2

  • MD5

    70cb8c5eb107648b853a3e6ee4d5003c

  • SHA1

    7bd2e7764531e09e884cd3b8e97a1484df2e8a11

  • SHA256

    2459438d8963402c140cc0cef2e8b755e85f8c1dee781c077f3171a9fbc19b6e

  • SHA512

    53bde0c54b3ac79643e3b44ad4c9c26a41ebe158fa47e6e4012d5f2593923da05f4931cf665590e045cd1f9b776fcf8162c32c57254399cee414813d3e272fd0

Score
10/10
formbookfgfpersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fgf

Decoy

cat5irma.com

leadershiplakewood.info

flm1tr.biz

silverstarps.com

tzsbhy.net

disseny-web-lleida.net

cancellationofcontract.com

potentialanalysen.com

realinja.net

cateraggio.com

17017brookwooddrive.com

liberty-hope.net

northmnsword.com

500lombardy.com

roykossena.com

bowelral.com

hidiinvestmentgroup.com

urbarecords.net

404chianti.com

zimomor.com

Targets

    • Target

      SwiftLCCM.scan.pdf..exe

    • Size

      378KB

    • MD5

      a3eec98af0fabb24461e543dc05e4ac9

    • SHA1

      ada78ad3c6dfc5ee6490c615094283f7ed4811f6

    • SHA256

      56b7da0dee74f57d90b0f1f5e1871c153d399521f9361a96dc3d298ae9f0d462

    • SHA512

      96cf4d0e789dce546a24081413a198c1ba51a753ce6b9ca85d1f8455b6112da2c1d5f96c47c8a2d14571ab96150375e277a7c32cedff99205dd35e8187856fd2

    Score
    10/10
    formbookfgfpersistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks