Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    156432010c9c69932d05b3420b22ae89d29e4d858e0626031ed4856f1b3a00cd

  • Size

    328KB

  • Sample

    230312-vpvjzsef26

  • MD5

    961c9c4f65267e43e44e13b6bf265f6f

  • SHA1

    33776c4a9f5989f733f6047cd3fbecb488d1688b

  • SHA256

    156432010c9c69932d05b3420b22ae89d29e4d858e0626031ed4856f1b3a00cd

  • SHA512

    40518c46518d6170793acbf7322b0ffebdafe38c627ec0810444b02ed73c4a5a2bc3bedde39dc6c6d214e6db33cfc253ffda6264bde9559b7593e9b6fdab20bb

  • SSDEEP

    6144:+Ya6e3D2t9hg068nDs+wW2bRmLhW4dlNNwl4jmfX5GJBL12Q0u:+YY3D2L68nDdwW2VUJdlNNQkmv5GZ2Qf

Score
10/10
formbookremcosremotehostho62collectionratspywarestealertrojanupx

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

top.noforabusers1.xyz:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-5DQBA4

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

formbook

Version

4.1

Campaign

ho62

Decoy

aqawonky.com

ancachsroadsideassistance.com

artologycreatlive.com

olesinfo.africa

lovebreatheandsleep.com

friendsofdragonsprings.com

homecomingmums.wiki

hg222.bet

precision-spares.co.uk

generalhospitaleu.africa

touchstone4x4.africa

dynamator.com

dental-implants-52531.com

efefear.buzz

bentonapp.net

89luxu.com

bridgesonelm.com

acesaigon.online

instantapprovals.loans

evuniverso.com

Targets

    • Target

      156432010c9c69932d05b3420b22ae89d29e4d858e0626031ed4856f1b3a00cd

    • Size

      328KB

    • MD5

      961c9c4f65267e43e44e13b6bf265f6f

    • SHA1

      33776c4a9f5989f733f6047cd3fbecb488d1688b

    • SHA256

      156432010c9c69932d05b3420b22ae89d29e4d858e0626031ed4856f1b3a00cd

    • SHA512

      40518c46518d6170793acbf7322b0ffebdafe38c627ec0810444b02ed73c4a5a2bc3bedde39dc6c6d214e6db33cfc253ffda6264bde9559b7593e9b6fdab20bb

    • SSDEEP

      6144:+Ya6e3D2t9hg068nDs+wW2bRmLhW4dlNNwl4jmfX5GJBL12Q0u:+YY3D2L68nDdwW2VUJdlNNQkmv5GZ2Qf

    Score
    10/10
    formbookremcosremotehostho62collectionratspywarestealertrojanupx

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Formbook payload

      rat

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks