Overview

overview

10

Static

static

1deac5c42c...fa.exe

windows7_x64

10

1deac5c42c...fa.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa

  • Size

    213KB

  • Sample

    220612-2yw8haegb4

  • MD5

    1af681084e3d0b909e8ff56e4cee3c80

  • SHA1

    fc8532c8feb0ce096e761020678744824dc1607c

  • SHA256

    1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa

  • SHA512

    b9d0d1cb4cf3ac31f0b5f772e8e7dcdd5c13b9410dc52d22dfa42c6d34f98b13582319688a52c3f85bc0d2f46782f621ded3cdd70be1401846b2fc2ee449e4bf

Score
10/10
formbookshpersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

sh

Decoy

studiogoparty.com

furi-mold.com

cdicoun-tombola.info

elizabethlhall.com

nakayama-hanasai.com

9910pe.com

iraqbreakingnews.com

91fyy.com

intersafetyland.com

dddadditive.com

gewuan.net

ikwxanxb.click

shenghangdianzi.com

nuskinmemory.com

sonrel-julie.com

rapidlegalcenter.com

jcldsp.com

dibamoviez.net

sochuan66.com

platformoneclothing.com

Targets

    • Target

      1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa

    • Size

      213KB

    • MD5

      1af681084e3d0b909e8ff56e4cee3c80

    • SHA1

      fc8532c8feb0ce096e761020678744824dc1607c

    • SHA256

      1deac5c42c5c12f811a14593da40c7589da9274b67086ac62174498923c893fa

    • SHA512

      b9d0d1cb4cf3ac31f0b5f772e8e7dcdd5c13b9410dc52d22dfa42c6d34f98b13582319688a52c3f85bc0d2f46782f621ded3cdd70be1401846b2fc2ee449e4bf

    Score
    10/10
    formbookshpersistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Scripting

1
T1064

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks