Overview

overview

10

Static

static

SecuriteIn...83.xls

windows7-x64

10

SecuriteIn...83.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Exploit.MathType-Obfs.Gen.25508.5883.xlsx

  • Size

    250KB

  • Sample

    221202-f52wnsge78

  • MD5

    ba0a934b6dd5af65ca9a82782d44e843

  • SHA1

    5957a4921c66e0bfae31d096e2a86a9c73feb5b0

  • SHA256

    0b97d2123754dc9e52e88001fc59c0343b37965172255bcc4b1d592c0df69309

  • SHA512

    989872eecb46877b649e6a4b17c79a6a4feb27b140aad43ff4d9215c364a2f94ec40fba3b25e34b68b7334adb76805daf434ec6eb6c99ff44bc7928f87162005

  • SSDEEP

    6144:yDZ+RwPONXoRjDhIcp0fDlavx+W26nARy0f/8v:y+/q

Score
10/10
formbookpr28ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pr28

Decoy

huaxinimg.com

baorungas.com

comercializadoramultimus.com

blr-batipro.com

wantagedfas.uk

1thingplan.one

cweilin.com

lorienconsultingllc.com

jdzsjwx.com

casafacil.site

hkacgt.com

hasid.africa

92dgr97k4hr9.com

cvbiop.xyz

1wbskm.top

fantasticmobility.com

goodchoice2022.com

hafizpower.com

familiajoya.com

fundscrahelp.info

Targets

    • Target

      SecuriteInfo.com.Exploit.MathType-Obfs.Gen.25508.5883.xlsx

    • Size

      250KB

    • MD5

      ba0a934b6dd5af65ca9a82782d44e843

    • SHA1

      5957a4921c66e0bfae31d096e2a86a9c73feb5b0

    • SHA256

      0b97d2123754dc9e52e88001fc59c0343b37965172255bcc4b1d592c0df69309

    • SHA512

      989872eecb46877b649e6a4b17c79a6a4feb27b140aad43ff4d9215c364a2f94ec40fba3b25e34b68b7334adb76805daf434ec6eb6c99ff44bc7928f87162005

    • SSDEEP

      6144:yDZ+RwPONXoRjDhIcp0fDlavx+W26nARy0f/8v:y+/q

    Score
    10/10
    formbookpr28ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks