Overview

overview

10

Static

static

1

SHIP101.exe

windows7-x64

10

SHIP101.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SHIP101.exe

  • Size

    948KB

  • Sample

    230310-t1cymsgc8y

  • MD5

    72be1dd76472cba29a36135e882526fe

  • SHA1

    be4b041b0c21162e389f4a9a1620fda5e0050713

  • SHA256

    6fb6a2160d5ceeef3420d09b7156d35e403ba7098bc0bdcadc9e721de1b3d5af

  • SHA512

    67ed20a8ba6c464d2abccf06b6a1af5215645a8812672f39b499ae52419b361d74065ebcfe3f9fb933722969619fb17e298a53898551953b00bc5c620e5587bc

  • SSDEEP

    24576:jDKmIirBQVM3P06E+eaioYJjkVxOCAEzh:j2mIqq6fqBaioY2oCAK

Score
10/10
formbookh3scratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

h3sc

Decoy

seemessage.com

bitlab.website

cheesestuff.ru

bhartiyafitness.com

bardapps.com

l7a4.com

chiara-samatanga.com

lesrollintioup.com

dropwc.com

mackey242.com

rackksfresheggs.com

thinkvlog.com

aidmedicalassist.com

firehousepickleball.net

sifreyonetici.com

teka-mart.com

ddttzone.xyz

macfeeupdate.com

ivocastillo.com

serjayparks.com

Targets

    • Target

      SHIP101.exe

    • Size

      948KB

    • MD5

      72be1dd76472cba29a36135e882526fe

    • SHA1

      be4b041b0c21162e389f4a9a1620fda5e0050713

    • SHA256

      6fb6a2160d5ceeef3420d09b7156d35e403ba7098bc0bdcadc9e721de1b3d5af

    • SHA512

      67ed20a8ba6c464d2abccf06b6a1af5215645a8812672f39b499ae52419b361d74065ebcfe3f9fb933722969619fb17e298a53898551953b00bc5c620e5587bc

    • SSDEEP

      24576:jDKmIirBQVM3P06E+eaioYJjkVxOCAEzh:j2mIqq6fqBaioY2oCAK

    Score
    10/10
    formbookh3scratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks