Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    271KB

  • Sample

    230131-qfhfvaac9y

  • MD5

    e3a576fda3253b1f5e57734e1d1d30ec

  • SHA1

    4da98990e681a5c9ea026960ca0150582088173d

  • SHA256

    2e919dbaca46898116a0aa387553a54f4711aea584ea9931e6ea49d89e8986b8

  • SHA512

    46a9280eff90efecb485ff491d43ae4ee62ac2e0ca2a0364b4749c1a4bf60bd49ed7d4dd2c1b9a9aa25e448776e5d172591b5df333c3965af7147631123ce64b

  • SSDEEP

    6144:/Ya6x5gt3OupNIRztp3FXl50iIj74HtMJh9plSNqw7mPONATWEsbSDYv:/YDSt3OX95l5uj8NMJZlSz7mPOO4SDE

Score
10/10
formbookw12eratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

w12e

Decoy

poshsalon.co.uk

ideeksha.net

eaglebreaks.com

exileine.me.uk

saveittoday.net

ceon.tech

estateagentswebsitedesign.uk

faropublicidade.com

depression-treatment-83678.com

informationdata16376.com

wirecreations.africa

coolsculpting-pros.life

ethoshabitats.com

amtindividual.com

gotoken.online

cherny-100-imec-msu.ru

historicaarcanum.com

gpsarhealthcare.com

kx1257.com

abdullahbinomar.com

Targets

    • Target

      file.exe

    • Size

      271KB

    • MD5

      e3a576fda3253b1f5e57734e1d1d30ec

    • SHA1

      4da98990e681a5c9ea026960ca0150582088173d

    • SHA256

      2e919dbaca46898116a0aa387553a54f4711aea584ea9931e6ea49d89e8986b8

    • SHA512

      46a9280eff90efecb485ff491d43ae4ee62ac2e0ca2a0364b4749c1a4bf60bd49ed7d4dd2c1b9a9aa25e448776e5d172591b5df333c3965af7147631123ce64b

    • SSDEEP

      6144:/Ya6x5gt3OupNIRztp3FXl50iIj74HtMJh9plSNqw7mPONATWEsbSDYv:/YDSt3OX95l5uj8NMJZlSz7mPOO4SDE

    Score
    10/10
    formbookw12eratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks