Overview

overview

10

Static

static

70c2bfb3dd...a3.exe

windows7-x64

10

70c2bfb3dd...a3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70c2bfb3dd7b6467020e6ca5d7f037a3.exe

  • Size

    340KB

  • Sample

    230125-1cf4qacd41

  • MD5

    70c2bfb3dd7b6467020e6ca5d7f037a3

  • SHA1

    3fef1cb454c1760936795c94f4504bf0f9ee00ba

  • SHA256

    ab0b1f056d4030a9988c12df83064169e07f5cd2a9e7c51833ff057d2d8eedf3

  • SHA512

    e43b2c79e0aa5223a633d2018ca04b3371a4242dd1da4c41a2dd2b5e4d815557f0e2704f0ef47f937802abc19495f16260800c3c0ed009e9b8c7a524cc39f538

  • SSDEEP

    6144:vYa6TI+l4BN5yJ4PE7baks7hlP/WUC7NRXTLYaJqSSFvVDzqFGcGn13:vYB4BN4+87baF7XGUERjLYaJqXQGcGnN

Score
10/10
formbookw12eratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

w12e

Decoy

poshsalon.co.uk

ideeksha.net

eaglebreaks.com

exileine.me.uk

saveittoday.net

ceon.tech

estateagentswebsitedesign.uk

faropublicidade.com

depression-treatment-83678.com

informationdata16376.com

wirecreations.africa

coolsculpting-pros.life

ethoshabitats.com

amtindividual.com

gotoken.online

cherny-100-imec-msu.ru

historicaarcanum.com

gpsarhealthcare.com

kx1257.com

abdullahbinomar.com

Targets

    • Target

      70c2bfb3dd7b6467020e6ca5d7f037a3.exe

    • Size

      340KB

    • MD5

      70c2bfb3dd7b6467020e6ca5d7f037a3

    • SHA1

      3fef1cb454c1760936795c94f4504bf0f9ee00ba

    • SHA256

      ab0b1f056d4030a9988c12df83064169e07f5cd2a9e7c51833ff057d2d8eedf3

    • SHA512

      e43b2c79e0aa5223a633d2018ca04b3371a4242dd1da4c41a2dd2b5e4d815557f0e2704f0ef47f937802abc19495f16260800c3c0ed009e9b8c7a524cc39f538

    • SSDEEP

      6144:vYa6TI+l4BN5yJ4PE7baks7hlP/WUC7NRXTLYaJqSSFvVDzqFGcGn13:vYB4BN4+87baF7XGUERjLYaJqXQGcGnN

    Score
    10/10
    formbookw12eratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks