Overview

overview

10

Static

static

1

PROFERT SP...E..rtf

windows7-x64

10

PROFERT SP...E..rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PROFERT SPA SCANNE..doc

  • Size

    26KB

  • Sample

    230321-vwzsaacb72

  • MD5

    4ff264c2efd8c0bba69030aa6a5fe31e

  • SHA1

    67d1da5490277818ee07faaa22c6e0314a80c2ef

  • SHA256

    5b2e65ed209acd3ee8ccb08afa456e4672aae7e3b61760cdf9540cf38ec13994

  • SHA512

    0f90fb22e1a78e3e7a73e220a275739b43d59df9b8f915f55a501e8f7df7b1eb1b84647c56d7df4d404701b5033a77177626f03f3c04713bf9b3f111d3aca41e

  • SSDEEP

    768:pFx0XaIsnPRIa4fwJMR6/gj65uwo4CguXl:pf0Xvx3EMRV65Lo4G1

Score
10/10
formbookdr62ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dr62

Decoy

juanbrujo.com

toptasker.africa

g-labs.one

1redbuckpermonth.com

lasolutions.online

beginagainmen.com

iearn.site

leading-car.ru

codigosindiabetes.fun

6y8ud.bond

fptmarket.shop

ctjhxv3.vip

huluxia2.xyz

piggg08.uk

kms-pico-tools.com

westonandcate.com

giftrendz.com

kqwdhrendfywefdst.top

anchitchoudhary.com

sistemodasi.net

Targets

    • Target

      PROFERT SPA SCANNE..doc

    • Size

      26KB

    • MD5

      4ff264c2efd8c0bba69030aa6a5fe31e

    • SHA1

      67d1da5490277818ee07faaa22c6e0314a80c2ef

    • SHA256

      5b2e65ed209acd3ee8ccb08afa456e4672aae7e3b61760cdf9540cf38ec13994

    • SHA512

      0f90fb22e1a78e3e7a73e220a275739b43d59df9b8f915f55a501e8f7df7b1eb1b84647c56d7df4d404701b5033a77177626f03f3c04713bf9b3f111d3aca41e

    • SSDEEP

      768:pFx0XaIsnPRIa4fwJMR6/gj65uwo4CguXl:pf0Xvx3EMRV65Lo4G1

    Score
    10/10
    formbookdr62ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks