Overview

overview

10

Static

static

ae5f04e193...od.exe

windows7-x64

10

ae5f04e193...od.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ae5f04e1939d8ce30342a717d15c99489f9afa411aacfdbc85a4f6af79013694-mod.exe

  • Size

    848KB

  • Sample

    221207-c3snfaba6y

  • MD5

    f5754653e12482d470ba49e6e4a56456

  • SHA1

    98d4aae9a159eea640d43ffe6900b25e44d4b5bb

  • SHA256

    8fddf1605031da46c75a4bcf9a38ac8868fb6ef9519828905f6e8435fa3875a4

  • SHA512

    2cfd20eeb8daddada5c2cdcc0f28e3baa069bde93ba2ee4dbe776be683019b0d12d29ac40356caa14949290cc0188db67412cbdcd60d89829d8e15a3c792498e

  • SSDEEP

    12288:rewy0O8ZrzM87QTdAz+VEYemZJbxpDF8VGmGqPBaynlmhGHqsSqyAeugqAPW6ETF:rewDljBa5hCuNZ/A6CgUPv

Score
10/10
formbookd0a7persistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d0a7

Decoy

ngpjqd.top

provider1.net

themetaverseloyalties.com

tylpp.com

pmjewels.com

87napxxgz8x86a.com

djolobal.com

fmbmaiamelo.com

naijabam.online

networkingbits.com

beesweet.live

sexarab.homes

promptcompete.com

midsouthradio.com

23mk.top

bnhkit.xyz

2ozp56.bond

vehiclesgroups.com

healthycommunitynow.com

cwzmesr.com

Targets

    • Target

      ae5f04e1939d8ce30342a717d15c99489f9afa411aacfdbc85a4f6af79013694-mod.exe

    • Size

      848KB

    • MD5

      f5754653e12482d470ba49e6e4a56456

    • SHA1

      98d4aae9a159eea640d43ffe6900b25e44d4b5bb

    • SHA256

      8fddf1605031da46c75a4bcf9a38ac8868fb6ef9519828905f6e8435fa3875a4

    • SHA512

      2cfd20eeb8daddada5c2cdcc0f28e3baa069bde93ba2ee4dbe776be683019b0d12d29ac40356caa14949290cc0188db67412cbdcd60d89829d8e15a3c792498e

    • SSDEEP

      12288:rewy0O8ZrzM87QTdAz+VEYemZJbxpDF8VGmGqPBaynlmhGHqsSqyAeugqAPW6ETF:rewDljBa5hCuNZ/A6CgUPv

    Score
    10/10
    formbookd0a7persistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks