Overview

overview

10

Static

static

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0

  • Size

    582KB

  • Sample

    220829-f2tqwsdea9

  • MD5

    4347c70ca7302f107a165d6fd272b0e6

  • SHA1

    1aa318f816e82fa3a047d61e4f79dd1b1765e89d

  • SHA256

    f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0

  • SHA512

    071bd1762a28d3a182c588fff09754c9f0bc23fb4cc7d4b8b5b378380161d835d6990ae03281d544a3aab87ed8ed201e4cb88a720275a8fe1427b34b49e6d854

  • SSDEEP

    12288:EE+7B92iNmUaevf9nf5fsuqy1ngZ6NfHJld0XTmT:5qz1xvjfdqyPP6X6T

Score
10/10
formbookde08evasionratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

de08

Decoy

retirecloudyyard.com

fabiyan.xyz

chrisarlyde.com

selapex.com

vivalosgales.com

specialty-medicine.com

contasesolucoes.com

satunusanews.net

allyibc.com

alameda1876.com

artofdala.com

yukoidusp.xyz

steeldrumbandnearme.com

stonewedgetechnology.com

kentonai.com

macquarie-private.com

ddgwy.com

megagreenhousekits.com

descomplicaomarketing.com

inclusiverealtor.com

Targets

    • Target

      f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0

    • Size

      582KB

    • MD5

      4347c70ca7302f107a165d6fd272b0e6

    • SHA1

      1aa318f816e82fa3a047d61e4f79dd1b1765e89d

    • SHA256

      f0520738f5b3e513d729ec8034c934ab84b803b5fb8c06cf328f279b42e89fa0

    • SHA512

      071bd1762a28d3a182c588fff09754c9f0bc23fb4cc7d4b8b5b378380161d835d6990ae03281d544a3aab87ed8ed201e4cb88a720275a8fe1427b34b49e6d854

    • SSDEEP

      12288:EE+7B92iNmUaevf9nf5fsuqy1ngZ6NfHJld0XTmT:5qz1xvjfdqyPP6X6T

    Score
    10/10
    formbookde08evasionratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks