Overview

overview

10

Static

static

QUOTE.exe

windows7-x64

10

QUOTE.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QUOTE.exe

  • Size

    705KB

  • Sample

    220804-lw79zsefcm

  • MD5

    69cce648572c35889b741d72ecfe9690

  • SHA1

    2a86fae70b64f4266fa653bd5742fb558e5a5d41

  • SHA256

    371982ab20054b57f6cd8698e9f64498c7a857b412d370febbf44d8cbe7f2285

  • SHA512

    3ec1973dbc4f2d55d3e567d9b38993f79ef8f8746c701445b3d9e5d4e021647eb4fec22e9775d4ecc342444b5f35f2fa7daa98a42b63a73ee27309efe4b28fde

Score
10/10
formbookee27ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ee27

Decoy

gasimportsfiles.com

hospitaljobsindia.com

mymortgagecantips.xyz

yourenotalone.world

livethejesuslife.com

sobernv.com

bobgruber.online

badu100.com

id98qq12.com

naturalex.co.uk

metathrillrides.com

blessingstowing.com

juddsbarandgrill.com

qrcodemania.com

haodaculture.com

obot.xyz

soupmortgagemark.xyz

top-road.com

xiaoterv.com

madrstyonline.com

Targets

    • Target

      QUOTE.exe

    • Size

      705KB

    • MD5

      69cce648572c35889b741d72ecfe9690

    • SHA1

      2a86fae70b64f4266fa653bd5742fb558e5a5d41

    • SHA256

      371982ab20054b57f6cd8698e9f64498c7a857b412d370febbf44d8cbe7f2285

    • SHA512

      3ec1973dbc4f2d55d3e567d9b38993f79ef8f8746c701445b3d9e5d4e021647eb4fec22e9775d4ecc342444b5f35f2fa7daa98a42b63a73ee27309efe4b28fde

    Score
    10/10
    formbookee27ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks