General

  • Target

    newfile.exe

  • Size

    996KB

  • Sample

    220803-s2f61sdfhj

  • MD5

    aea0bc608b434a27bd12ec5520f12c89

  • SHA1

    0779f1b1918c04a25d006fc2f94979d7a240fd4a

  • SHA256

    97e97eb7101472750099ba0404381a34952bcb0114e91a63c7ad241510691cdd

  • SHA512

    78ffb5b5a9835e03e663b16034e88efe33ea65e54657bb7bb2c2396046b6e2dbb4bd0e97855a6c7c18d70a8e32bc5a0cfcc238f9220f35eb40559da93070bfef

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

o2e7

Decoy

genvivwink.com

paramotos.space

bolsanoir.com

techblog.asia

seophreak.com

agitationt.net

jenniferlearmontcelebrant.com

biggsales.space

barkerprintsolutions.com

jesuspatriot.com

clinicaamadeolosmochis.com

lowbackpaindecoded.com

mumbaimasjid.com

masooliflourmillers.com

incopetent.com

andresramosweb.com

betonamubukkyoshinjakai.com

pukimail.net

erohlimitcrown.site

bodogegarden.com

Targets

    • Target

      newfile.exe

    • Size

      996KB

    • MD5

      aea0bc608b434a27bd12ec5520f12c89

    • SHA1

      0779f1b1918c04a25d006fc2f94979d7a240fd4a

    • SHA256

      97e97eb7101472750099ba0404381a34952bcb0114e91a63c7ad241510691cdd

    • SHA512

      78ffb5b5a9835e03e663b16034e88efe33ea65e54657bb7bb2c2396046b6e2dbb4bd0e97855a6c7c18d70a8e32bc5a0cfcc238f9220f35eb40559da93070bfef

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Formbook payload

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks