Overview

overview

10

Static

static

Irrazvdr.exe

windows7_x64

10

Irrazvdr.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Irrazvdr.exe

  • Size

    54KB

  • Sample

    220706-qq9m3sdcbp

  • MD5

    cedb27004e2fbaf88af7850aaf5133b0

  • SHA1

    1ea8386b3a52bb32ae24f41ba0ef4f912eada74c

  • SHA256

    2cbb67b48b3162ce44c224d9230d58a4263e71a50ca82673477d2e14f7ae2087

  • SHA512

    3dd1a35ab8d59db4b933190906e9d039459c8d7e39849819d6ba9ac214f57f826bf6ab3342f132971b104016779035704efb1dd5e000af1419e83a0060a79521

Score
10/10
formbookca27persistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ca27

Decoy

sefacoin.com

rightvisionsecuritysystems.com

jthousing1509.com

bj-sfxh.com

fansdy.com

waltit.com

kgaelhp.icu

latil.sa.com

ethmerger.com

theunimarkgroup.com

51anb.com

betsinatra.com

asd3wuh.icu

vinissimo3gwen.xyz

supernewshub.site

asfq4ev.icu

nftstoremarketing.com

blondefitgal.com

zmsoftware-co.com

beedotech.net

Targets

    • Target

      Irrazvdr.exe

    • Size

      54KB

    • MD5

      cedb27004e2fbaf88af7850aaf5133b0

    • SHA1

      1ea8386b3a52bb32ae24f41ba0ef4f912eada74c

    • SHA256

      2cbb67b48b3162ce44c224d9230d58a4263e71a50ca82673477d2e14f7ae2087

    • SHA512

      3dd1a35ab8d59db4b933190906e9d039459c8d7e39849819d6ba9ac214f57f826bf6ab3342f132971b104016779035704efb1dd5e000af1419e83a0060a79521

    Score
    10/10
    formbookca27persistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook Payload

      rat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks