Overview

overview

10

Static

static

SecuriteIn...30.rtf

windows7-x64

10

SecuriteIn...30.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Exploit.CVE-2018-0798.4.27084.13530.rtf

  • Size

    4KB

  • Sample

    221206-pyg3cscg7t

  • MD5

    c746fc38543961ccceb2d8479563eb24

  • SHA1

    bdcd20367cf10fba4e469fd7686f5954bf059bb0

  • SHA256

    90e73df4afa607e8067725397493c2781c69b1c2afa6e155c262ee90cb6e3a79

  • SHA512

    8ecc5025be36392d874e70e6fc1188584bfc5ed64aed628ddb9d5e384b15353f5bead449d9bbb29e7816b4f585a97462eea865c5d6b1e84dc99495ce5964260e

  • SSDEEP

    96:FtnJKExwV6jHtAFNo02KG2VHWGRr2juUes5wO5IUfMAWf4FjJiJsh:Flb06jHmi02d2dZrSrlSO5IUfMAogjJB

Score
10/10
formbookwh23ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

wh23

Decoy

ow9vyvfee.com

alvis.one

mutantgobz.claims

plynofon.com

southofkingst.store

nuvidamedspa.com

coffeeforyou56.com

opaletechevents.com

momobar.life

abcmousu.com

learnicd-11.com

tipokin.xyz

kahvezevki.com

suratdimond.com

oldartists.best

infoepic.info

mattresslabo.com

skarlmotors.com

cl9319x.xyz

med49app.net

Targets

    • Target

      SecuriteInfo.com.Exploit.CVE-2018-0798.4.27084.13530.rtf

    • Size

      4KB

    • MD5

      c746fc38543961ccceb2d8479563eb24

    • SHA1

      bdcd20367cf10fba4e469fd7686f5954bf059bb0

    • SHA256

      90e73df4afa607e8067725397493c2781c69b1c2afa6e155c262ee90cb6e3a79

    • SHA512

      8ecc5025be36392d874e70e6fc1188584bfc5ed64aed628ddb9d5e384b15353f5bead449d9bbb29e7816b4f585a97462eea865c5d6b1e84dc99495ce5964260e

    • SSDEEP

      96:FtnJKExwV6jHtAFNo02KG2VHWGRr2juUes5wO5IUfMAWf4FjJiJsh:Flb06jHmi02d2dZrSrlSO5IUfMAogjJB

    Score
    10/10
    formbookwh23ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks