Overview

overview

10

Static

static

1

H3409D.exe

windows7-x64

10

H3409D.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    H3409D.exe

  • Size

    770KB

  • Sample

    230313-ng3r3aab45

  • MD5

    8173c4f1aab9e70409d795b904d1b30b

  • SHA1

    ca3a7fa60e5f910647316450c257a11aab8e7299

  • SHA256

    d69785e0fa78ddb451072e232164234057e49a7671695c33c0db64adba871e44

  • SHA512

    0815ae280189619c39bbffc0b75a93d499363c1389c2e3c98eadce769f47d775e81be2bf3d293b6c4bb9e51a41d1398f2130c93983152adc19e25918835c6cb9

  • SSDEEP

    12288:gKLJyUZiUWf0sSEpcwXybqAsespUI2PRl/NnLLm:fly1UWf0s7qwXwI1pUDZl/NnLL

Score
10/10
formbookmodiloaderh3scpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

h3sc

Decoy

seemessage.com

bitlab.website

cheesestuff.ru

bhartiyafitness.com

bardapps.com

l7a4.com

chiara-samatanga.com

lesrollintioup.com

dropwc.com

mackey242.com

rackksfresheggs.com

thinkvlog.com

aidmedicalassist.com

firehousepickleball.net

sifreyonetici.com

teka-mart.com

ddttzone.xyz

macfeeupdate.com

ivocastillo.com

serjayparks.com

Targets

    • Target

      H3409D.exe

    • Size

      770KB

    • MD5

      8173c4f1aab9e70409d795b904d1b30b

    • SHA1

      ca3a7fa60e5f910647316450c257a11aab8e7299

    • SHA256

      d69785e0fa78ddb451072e232164234057e49a7671695c33c0db64adba871e44

    • SHA512

      0815ae280189619c39bbffc0b75a93d499363c1389c2e3c98eadce769f47d775e81be2bf3d293b6c4bb9e51a41d1398f2130c93983152adc19e25918835c6cb9

    • SSDEEP

      12288:gKLJyUZiUWf0sSEpcwXybqAsespUI2PRl/NnLLm:fly1UWf0s7qwXwI1pUDZl/NnLL

    Score
    10/10
    modiloadertrojanformbookh3scpersistenceratspywarestealer

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Formbook payload

      rat

    • ModiLoader Second Stage

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks