Overview

overview

10

Static

static

1

Inv #CI-OMG200196.exe

windows7-x64

8

Inv #CI-OMG200196.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Inv #CI-OMG200196.exe
  • Size 692KB
  • Sample221102-1srv6acah4
  • SHA256 e15347eeeba6fb5f12440c9c2720d8055747cd973fde267d7e159f40efa62ab5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooknf35ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Campaign

  • nf35

Decoy

  • tBnrD3YKFOOZL5Y=

  • iDWqMmvFXWdPjwrVyg==

  • Mi+2XYdTddDZjOFylYbC75w=

  • 0CngqOrR1wIPvRDlxffi5ow=

  • 0A/A3EXbosXuAiXn0w==

  • B/vQ9VhlqkveYLN3WSyC9KhVaVLC

  • jDG6d+p8NVnbSKM3k9X49qKGmmA8rOg=

  • D0Ph2f5O/+Ubmg/nyg==

  • Virrs5Ryq0nmaeTXw9/T9JU=

  • B8l/lfoUXwS6/fvczt/T9JU=

  • bYcGzDhAixEnGR7zcO2JF79VaVLC

  • JwcApzyrhEtKIQ==

  • PS4USZ9kULjr4KpwpNEn8w==

  • jdV+IANzTFXuYOPgz/fi5ow=

  • Vv2tgOmx4lZlPybYj9hj

  • t+qr3Eq1TfBDC/nq1Q==

  • jKk21gjq81fDf3ll

  • o8tyfKj+n4Yu+y8hl+crD+W3WU/K

  • kO+vd4HbxIyEOg==

  • o3E0Q6S7+V9pV1E+rZ3LU//SfkWCOFS+Xw==

Targets

    • Target
      Inv #CI-OMG200196.exe
    • Size 692KB
    • SHA256 e15347eeeba6fb5f12440c9c2720d8055747cd973fde267d7e159f40efa62ab5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooknf35ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks