Overview

overview

10

Static

static

Gkjesdjokh...ao.exe

windows7-x64

1

Gkjesdjokh...ao.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Gkjesdjokhownhmnzenqhirureonvyzjao.exe

  • Size

    715KB

  • Sample

    220808-lmb57agghk

  • MD5

    e339968bd4859d65b757ef83159b0488

  • SHA1

    136c9c38a58ccbc9c6bebb48bba6100fc6eff206

  • SHA256

    5fabffc9eb6177ac29a1e51bf2a8bde55ddd97e2f7c86134eb2512b927f1232e

  • SHA512

    d134f5c7a6fbb61f0c4645e539b318e8dfe7eb83cfe9bfd198e5ea4161e3ab0aa5dd4148a6ba8454363080c483ca9225b3fa708181de7f86617fc24427280536

Score
10/10
formbookmodiloadero2e7persistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

o2e7

Decoy

genvivwink.com

paramotos.space

bolsanoir.com

techblog.asia

seophreak.com

agitationt.net

jenniferlearmontcelebrant.com

biggsales.space

barkerprintsolutions.com

jesuspatriot.com

clinicaamadeolosmochis.com

lowbackpaindecoded.com

mumbaimasjid.com

masooliflourmillers.com

incopetent.com

andresramosweb.com

betonamubukkyoshinjakai.com

pukimail.net

erohlimitcrown.site

bodogegarden.com

Targets

    • Target

      Gkjesdjokhownhmnzenqhirureonvyzjao.exe

    • Size

      715KB

    • MD5

      e339968bd4859d65b757ef83159b0488

    • SHA1

      136c9c38a58ccbc9c6bebb48bba6100fc6eff206

    • SHA256

      5fabffc9eb6177ac29a1e51bf2a8bde55ddd97e2f7c86134eb2512b927f1232e

    • SHA512

      d134f5c7a6fbb61f0c4645e539b318e8dfe7eb83cfe9bfd198e5ea4161e3ab0aa5dd4148a6ba8454363080c483ca9225b3fa708181de7f86617fc24427280536

    Score
    10/10
    formbookmodiloadero2e7persistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks