Overview

overview

10

Static

static

ADASU AKU-GIB2022.exe

windows7-x64

10

ADASU AKU-GIB2022.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ADASU AKU-GIB2022.exe

  • Size

    1.3MB

  • Sample

    220915-p4q78agghp

  • MD5

    e124339f08506d6b5bab4d071784a65e

  • SHA1

    bcac9d8f2919ed3e57ad78f4a5c999b3b9faf88f

  • SHA256

    8f8813e3ed0cdb3ac92de8e6003bc83c0ec859fc717748cab6a45f56a98a9201

  • SHA512

    0d8c3949cd7cdd07264398dbf9a6224c6ab40af0ee81d1936bb2a436f25981309958f5f9c405ad5553890cf94dd7f55667a07b44336ffefbc90c0127e8825df9

  • SSDEEP

    24576:rAOcZ8hI77JrtcZ2iYLwHQciT79xUkjPV99npuezy71oporahX:ta79pcZ2iM+QHTjUkj9fZe6Gc

Score
10/10
formbookmh76ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mh76

Decoy

healthgovcalottery.net

wenxinliao.com

rooterphd.com

bbobbo.one

american-mes-de-dezembro.xyz

mintager.com

thespecialtstore.com

wemakegreenhomes.com

occurandmental.xyz

fidelityrealtytitle.com

numerisat.asia

wearestallions.com

supxl.com

rajacumi.com

renaziv.online

blixtindustries.com

fjljq.com

exploretrivenicamping.com

authenticusspa.com

uucloud.press

Targets

    • Target

      ADASU AKU-GIB2022.exe

    • Size

      1.3MB

    • MD5

      e124339f08506d6b5bab4d071784a65e

    • SHA1

      bcac9d8f2919ed3e57ad78f4a5c999b3b9faf88f

    • SHA256

      8f8813e3ed0cdb3ac92de8e6003bc83c0ec859fc717748cab6a45f56a98a9201

    • SHA512

      0d8c3949cd7cdd07264398dbf9a6224c6ab40af0ee81d1936bb2a436f25981309958f5f9c405ad5553890cf94dd7f55667a07b44336ffefbc90c0127e8825df9

    • SSDEEP

      24576:rAOcZ8hI77JrtcZ2iYLwHQciT79xUkjPV99npuezy71oporahX:ta79pcZ2iM+QHTjUkj9fZe6Gc

    Score
    10/10
    formbookmh76ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks