Overview

overview

10

Static

static

4ac2c172c2...dd.exe

windows7-x64

10

4ac2c172c2...dd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4ac2c172c26b2d7542326c6787f18d76c94b0fe040dbf9c7ea3c3d5595fcfadd

  • Size

    476KB

  • Sample

    221125-kar57sde55

  • MD5

    c67f5e0a1b70379e571ad98dfabf90fa

  • SHA1

    cf5c2c9c424bfa81fe5f7ecf3fa1882078743bb8

  • SHA256

    4ac2c172c26b2d7542326c6787f18d76c94b0fe040dbf9c7ea3c3d5595fcfadd

  • SHA512

    125e0b7d24efc7491c0aca2f21d7c88146cfd4f76536ca8e6a5e8316fee5f4e5234adf23e0ca5d94e49999875dc381dff481a8e39424fd8049bc62379dc9d783

  • SSDEEP

    12288:321dDwwJjHJ7qMUELjQl8BAxdPOsEguyUI:cdDwwJRjUELjQlrkG

Score
10/10
formbookchpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

ch

Decoy

pardes.club

gpovisual.net

radio-garden.net

opebet977.com

buscaaps.com

teeveebox.net

recetasdepollo.online

fona.ltd

wensouder.net

swichitup.com

korian-foundation.info

shantinglvka.com

filmtipps.online

www1024sj.com

secretsofatrade.com

banquedabidjan.com

lifewayfoodscom.com

heidimcquinntp.com

tiendaportv.com

jenzamzow.com

Targets

    • Target

      4ac2c172c26b2d7542326c6787f18d76c94b0fe040dbf9c7ea3c3d5595fcfadd

    • Size

      476KB

    • MD5

      c67f5e0a1b70379e571ad98dfabf90fa

    • SHA1

      cf5c2c9c424bfa81fe5f7ecf3fa1882078743bb8

    • SHA256

      4ac2c172c26b2d7542326c6787f18d76c94b0fe040dbf9c7ea3c3d5595fcfadd

    • SHA512

      125e0b7d24efc7491c0aca2f21d7c88146cfd4f76536ca8e6a5e8316fee5f4e5234adf23e0ca5d94e49999875dc381dff481a8e39424fd8049bc62379dc9d783

    • SSDEEP

      12288:321dDwwJjHJ7qMUELjQl8BAxdPOsEguyUI:cdDwwJRjUELjQlrkG

    Score
    10/10
    formbookchpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks