Overview

overview

10

Static

static

payload.exe

windows7-x64

10

payload.exe

windows10-2004-x64

10

Resubmissions

18/10/2022, 20:13

221018-yzmhxadee710

18/10/2022, 14:28

221018-rs73psgba710

Sharing

Copy URL Twitter E-mail

General

  • Target
    payload.exe
  • Size 185KB
  • Sample221018-yzmhxadee7
  • SHA256 5017913bca4c5c1eaf5646e3983f9d8fc4e52f4a66406f46f3029952ae1fde70
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookknntpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • knnt

Decoy

  • 65SBubRb0cQTZyel+RrmtuIytWG7hIY=

  • lxY8gZLYuXPYl40/

  • IBCcbQLOUkWVL3cA/DkK2ei+vuKlXA==

  • 4Lo6dar405m4hxqWl58sOc0=

  • 4KyQBqNrzYWTI6Iv016m7BZVvuKlXA==

  • PyCmasPI0Lj0JTU=

  • hnoGNwDmybXus0PVH2S1Td2l0ZTJ

  • s4CRDagqgmaCo9bOBD4i

  • T5IbS3G46ZbN8RncbsWuAiWl0ZTJ

  • 2vxQ/T6e+7vkjz9yriaOpBbO8bYapwAu

  • 55558Jha4dgR7PCZrQ==

  • O9KAFJVY3c4V1Xi2rEGne4ZMtSY=

  • ZPih22lkYU3Yl40/

  • mCc1tbkLsWeH

  • MpbgOtnQvGu9jQ==

  • D6uAq4Gdj3UEkzmKkCOIW4BG

  • A3rp8NpDzp2Q

  • 4WMaDz2Ff26SfX5xEaABgk0WTQ==

  • G16+qE5AFMf20h0PxfsyLIZMtSY=

  • az44qCVNL8dm2vG/nuEbI3K46HT5K44=

Targets

    • Target
      payload.exe
    • Size 185KB
    • SHA256 5017913bca4c5c1eaf5646e3983f9d8fc4e52f4a66406f46f3029952ae1fde70
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookknntpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks