Overview

overview

10

Static

static

1

53495ecf8b...c9.exe

windows7-x64

10

53495ecf8b...c9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53495ecf8b97a44f42431f7a069d6d993728788af54c20ce7ece289640c3e1c9

  • Size

    334KB

  • Sample

    221121-ycke2ahd5v

  • MD5

    2c74b401820174296f5f421a431970d0

  • SHA1

    4801a6235cfe2ad17fa7171d352e49185939afb4

  • SHA256

    d24b7e7271c82af4f78b94743d6db6b3d224d0aaf7cb54038445356e229c8df0

  • SHA512

    1c74f71b3caed10b7beb16676f3ab1249a0f513424fd924b22a9109d6614d215c05a065d5d0daff84eed321189cf18d735185d9c89274b1fa3fb97827bc75bf5

  • SSDEEP

    6144:fQT6JTLWbYW5/UBrohXew3S4WKkmHMQIKXNa6OvtJee/Qa+JfdiJniGBE:ff16bY9wew3JWKhOvtJetdMn/E

Score
10/10
formbooksk19ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sk19

Decoy

21diasdegratitud.com

kx1993.com

chasergt.com

837news.com

naturagent.co.uk

gatorinsurtech.com

iyaboolashilesblog.africa

jamtanganmurah.online

gguminsa.com

lilliesdrop.com

lenvera.com

link48.co.uk

azinos777.fun

lgcdct.cfd

bg-gobtc.com

livecarrer.uk

cbq4u.com

imalreadygone.com

wabeng.africa

jxmheiyouyuetot.tokyo

Targets

    • Target

      53495ecf8b97a44f42431f7a069d6d993728788af54c20ce7ece289640c3e1c9

    • Size

      357KB

    • MD5

      8babf47c462b4c9dc2e4331d2cbbce2b

    • SHA1

      9b3f3e7ab491450cfb595584d316a48cdf6c9138

    • SHA256

      53495ecf8b97a44f42431f7a069d6d993728788af54c20ce7ece289640c3e1c9

    • SHA512

      518c2fa8b1ec096079cbc54f49c0ce8df7a1e0c8c590c4e993e8013cc17f565cc125e9441c80c946bbfd4e7aa7e3741f7c9cc8c8a3d0eae171c8ea76e68c461a

    • SSDEEP

      6144:HEa0eDyf/UBrohN9DYGWKkmHiQIKXNa6OltJae/Sa+tSV93niGBk:LdNGWKhcltJatSf3n/k

    Score
    10/10
    formbooksk19ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks