2459438d8963402c140cc0cef2e8b755e85f8c1dee781c077f3171a9fbc19b6e

General
Target

2459438d8963402c140cc0cef2e8b755e85f8c1dee781c077f3171a9fbc19b6e

Size

258KB

Sample

220521-pygftsgbg2

Score
10 /10
MD5

70cb8c5eb107648b853a3e6ee4d5003c

SHA1

7bd2e7764531e09e884cd3b8e97a1484df2e8a11

SHA256

2459438d8963402c140cc0cef2e8b755e85f8c1dee781c077f3171a9fbc19b6e

SHA512

53bde0c54b3ac79643e3b44ad4c9c26a41ebe158fa47e6e4012d5f2593923da05f4931cf665590e045cd1f9b776fcf8162c32c57254399cee414813d3e272fd0

Malware Config

Extracted

Family formbook
Version 4.1
Campaign fgf
Decoy

cat5irma.com

leadershiplakewood.info

flm1tr.biz

silverstarps.com

tzsbhy.net

disseny-web-lleida.net

cancellationofcontract.com

potentialanalysen.com

realinja.net

cateraggio.com

17017brookwooddrive.com

liberty-hope.net

northmnsword.com

500lombardy.com

roykossena.com

bowelral.com

hidiinvestmentgroup.com

urbarecords.net

404chianti.com

zimomor.com

beyaqi.com

flc282.com

digimaxmw.com

movble.net

nauticallion.info

august12v.com

top-amatrice.com

xn--takrcke24-y2a.com

balada.online

bleaktochic.info

jackpotfix.com

mindful-math-tutoring.com

scenia-bay-nhatrang.com

platapormicasa.com

klb2xu.info

greenrayciel.com

animalcontrolportstluciefl.com

rewarded.tech

beushopping.com

columbiapacific.site

hifholdings.com

for.watch

steeleawayfarm.net

gotaphoto.com

we-teams.com

feiya-group.com

repulift.com

liminaireschauffeurs.com

bottegamente.com

yutanfu.com

Targets
Target

SwiftLCCM.scan.pdf..exe

MD5

a3eec98af0fabb24461e543dc05e4ac9

Filesize

378KB

Score
10/10
SHA1

ada78ad3c6dfc5ee6490c615094283f7ed4811f6

SHA256

56b7da0dee74f57d90b0f1f5e1871c153d399521f9361a96dc3d298ae9f0d462

SHA512

96cf4d0e789dce546a24081413a198c1ba51a753ce6b9ca85d1f8455b6112da2c1d5f96c47c8a2d14571ab96150375e277a7c32cedff99205dd35e8187856fd2

Tags

Signatures

  • Formbook

    Description

    Formbook is a data stealing malware which is capable of stealing data.

    Tags

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    Description

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    Tags

  • Formbook Payload

    Tags

  • Deletes itself

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Tasks

                      static1

                      behavioral2

                      1/10