Overview

overview

10

Static

static

5987fe9f95...e8.exe

windows7-x64

10

5987fe9f95...e8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8

  • Size

    305KB

  • Sample

    220724-d74ryadhem

  • MD5

    ffa3fb48a339894ea095d4daf804011c

  • SHA1

    1d9466444dad77922aec5a800fef77b83b715c18

  • SHA256

    5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8

  • SHA512

    6327a1b44a08446a6d21a5357d833187fc575bbf570f3e324c27f8545a2f458c4fa057b88b1a0dae5fcfee0c9852f94615b011fdb5341afaab6dcde55e6bc05e

Score
10/10
formbookhx237persistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

hx237

Decoy

repuestosmamparaselsur.com

sakai-yukiko.com

getdistrict.com

hideinplainflight.info

yamaer.com

hoosholic-boy.com

thecopenhagencopywriter.com

ledressingdescompulsives.com

xn--h3t926bkqa394a.com

nvcxr.com

zhangbin2016.com

ajsfibresolutions.net

229riverbendlane.com

gnimble.com

pichacola.com

kochang.online

fishonfellowship.com

mandarinassinpepitas.com

drinkopr.win

silverm.cloud

Targets

    • Target

      5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8

    • Size

      305KB

    • MD5

      ffa3fb48a339894ea095d4daf804011c

    • SHA1

      1d9466444dad77922aec5a800fef77b83b715c18

    • SHA256

      5987fe9f952269fd60745e05998f3640516bfc8bd4a882db60683f423a2a94e8

    • SHA512

      6327a1b44a08446a6d21a5357d833187fc575bbf570f3e324c27f8545a2f458c4fa057b88b1a0dae5fcfee0c9852f94615b011fdb5341afaab6dcde55e6bc05e

    Score
    10/10
    formbookhx237persistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook payload

      rat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks