Overview

overview

10

Static

static

MY0025007022.exe

windows7-x64

10

MY0025007022.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MY0025007022.zip

  • Size

    7KB

  • Sample

    220725-knqvasbfbl

  • MD5

    6e11f965f7dd2978919e2f4b46c1b389

  • SHA1

    b0dd7731fe6721414ed1b9ad83a0b4faa066e57d

  • SHA256

    4c3ef62fadfcb2add42105636653251735afa0c6de4ab4fd61287e35580d97e7

  • SHA512

    d9441535bfec5144e3262eec502f8d90bed32175b7161d0c046714910b80942a828534c6a72ed3b111fbbbeb3acbc9eec0e39d7b91fc50e3a40fc940c6a6ab8d

Score
10/10
formbookfs44ratspywarestealersuricatatrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fs44

Decoy

whneat.com

jljcw.net

pocodelivery.com

outofplacezine.com

yavuzcansigorta.com

xinhewood-cn.com

cartogogh.com

5avis.com

joyceyong.art

digitalsurf.community

blackcreekbarns.com

magazinedistribuidor.com

sportsgross.com

drevom.online

mayibeofservice.com

gareloi-digit.com

permitha.net

renaissanceestetica.com

facts-r-friends.com

dach-loc.com

Targets

    • Target

      MY0025007022.exe

    • Size

      67KB

    • MD5

      09d635e7fac13ca49037a27ffa10cdbf

    • SHA1

      b12b7a877682838b5b1673ee4783bbf44eba4863

    • SHA256

      b12c23f3cf0937291c634f1505ca5123dc08363dcc0f766ac029b1238cade11d

    • SHA512

      f50052ccd601ef2830e0c1a5df7e4414249e55acc8aeef3a0eb1ca16f8d92da372ae25a94fc6a9deda85a812e01104f9000b429dc70cbcab0bc6fb46aaf12f85

    Score
    10/10
    formbookfs44ratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks