formbook

General

Target

New PO-RJ-IN-003 - Knauf Queimados.7z
Size

291KB
Sample

221129-qmtsfscg35
MD5

835b313319cfb04b8bb21c673f32541c
SHA1

b7e3de9005223f1384b5809fe7bc3f58dd2ad124
SHA256

f251e63c6a599dd80da55e413f7571bf514213ed18c0816a40a4939eca6fe1e1
SHA512

f3a03cbf75670d1a33df1a01a4a234fa077565186dd532f7f76850f9fb6dc967a70fe9d134d662a64c5384ee39864033d1d172e0630bcd4181005daf89396f4e
SSDEEP

6144:lUXZaKr78p1vrgT/+H9I/LSUiBdqyTMLe7T5m8AGANts:+XZlr741v0TGdcLSJrMLOlm8KNy

Score

10^/10

Malware Config

Extracted

Family

formbook

Campaign

m9ae

Decoy

nWTQpX6TYm6dfT3Lcw==

7JaBLgMm8EKn2AlTy5Ksj4Jq

yWRJIhE3viQgqEpZS3o=

ES9dFo0bytF8vlvRcg==

aX/aBZn29pD+cg==

lU64sYOZV7ZVpUy1ag==

9BpOCYAPv8L8TyIFAiTp2PSqLg==

uEJ2RyQ1BcBXfFr8kT5Z1KV0

oVM42Ury9pD+cg==

0Zl3VkcuKaY+

OjZeGI8dw67Z6eWtnOoBfoI=

ytwFn9j4i+N8nKYRSgcfh3xn5LU=

xMb1+YkOyxmbxJ53JsP7Pg==

HODQpzTBS1gVoi4X0hStKQ==

fQ417ycwD+ziKt1u0hStKQ==

nsApOqE62sA8uS735uCXVP+YcrQ=

4aobG3oZ3AHqTPs=

P2LEwJatZbQZUTayTW0=

/bopO7NR6clCfT3Lcw==

bBxRRkFY01R+20pZS3o=

Targets

- Target
  
  New PO-RJ-IN-003 - Knauf Queimados.exe
- Size
  
  396KB
- MD5
  
  244fc9610f75225aa3dc09958195beb1
- SHA1
  
  ef0d6103d27090fc9d25e3ef3de2e1b6d9670d9c
- SHA256
  
  05cdda3567b913d99627f8e41336404d5830816df65e1001d6b2ad05bd9ed18d
- SHA512
  
  5e37d34becf476a92c2b14917819c9f9366d99313e971554b4a94d4fe09e05a761355033b5bb59faf3d0a1e34621c31891ff4e5656a379aa581792a7ecc82f16
- SSDEEP
  
  6144:hBn7A5jMUCoQUg+p1vrgTr+H9I/LKUsBdVyXMLCMT5u9AG7Nmf:vrZ+1v0TSdcLKj0MLtlu9VNG
Score

10^/10

formbook m9ae persistence rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2