Overview

overview

10

Static

static

SWIFT_5201...df.exe

windows7-x64

10

SWIFT_5201...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SWIFT_5201660828948016.pdf.exe

  • Size

    12KB

  • Sample

    220805-zh5htsegar

  • MD5

    7735d8206f9275cf9d880695f5c51b1e

  • SHA1

    df731f57a07985af8dc540d9cb828cbce2513a32

  • SHA256

    bd653c9f26663d5ceb9c21dcbefb79f4a6c3d28e9c2363857a51d4daeab04a71

  • SHA512

    855c0fa50de7679f8c05e5e13a1c53372ebac007a2169b9916214479e1031e31939a322057bc48ee9d3b105cbe2c46dda33b65986c6619e10615733f4ead7b13

Score
10/10
formbooks4s9ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s4s9

Decoy

qianyuandianshang.com

bernardklein.com

slhomeservices.com

findasaas.com

janellelancaster.xyz

umkpro.site

nr6949.online

mersquare.club

lanariproperties.com

3rdeyefocused.com

giftexpress8260.xyz

hilleleven.xyz

beajod.com

kosazs.online

ishare.team

mb314.com

xjjinxingda.com

ayekooprojectamazing.com

ballsybanter.com

todayshoppingbd.com

Targets

    • Target

      SWIFT_5201660828948016.pdf.exe

    • Size

      12KB

    • MD5

      7735d8206f9275cf9d880695f5c51b1e

    • SHA1

      df731f57a07985af8dc540d9cb828cbce2513a32

    • SHA256

      bd653c9f26663d5ceb9c21dcbefb79f4a6c3d28e9c2363857a51d4daeab04a71

    • SHA512

      855c0fa50de7679f8c05e5e13a1c53372ebac007a2169b9916214479e1031e31939a322057bc48ee9d3b105cbe2c46dda33b65986c6619e10615733f4ead7b13

    Score
    10/10
    formbooks4s9ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks