Overview

overview

10

Static

static

1

Items Required.pdf

windows7-x64

10

Items Required.pdf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Items Required.pdf

  • Size

    3.1MB

  • Sample

    230322-l2lceaab2y

  • MD5

    7bce6abaafcc35245df3d74e76855558

  • SHA1

    678f93c6d46c3194a4440e9e7856e21efd84c198

  • SHA256

    752d06bd8ff5e075fb69e52626f9983bcfeb51e5eed191ebbf7ca453bc524d1d

  • SHA512

    c6ebfa6f8a4e7aee8e74127bf714e7a6918d03daa52ea1abaa3e653baf91e6bf3ce42a7130460b98b0034c694e42705a6d4ccd3a269845640b7b5ccdfc513358

  • SSDEEP

    98304:T4R97CScENc/i//clqkMRScE1416sXHWiLLVKG:/ScENc/i//clqkMRScE1413nnkG

Score
10/10
formbookbk08ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bk08

Decoy

chloie.net

fastingersecure.monster

foundersterrace.online

ytorly.xyz

kiralayolla.com

corporacionalpi.com

planfortheworld.com

disciplinecoaching.co.uk

rubi33.com

digitlabmedia.com

ky20033.com

h4q7.com

91ye260.xyz

coconceptevents.com

ukusizas.africa

utainnovative.africa

ted-clean.co.uk

haus-huelsche.com

ca-refund.website

football.salon

Targets

    • Target

      Items Required.pdf

    • Size

      3.1MB

    • MD5

      7bce6abaafcc35245df3d74e76855558

    • SHA1

      678f93c6d46c3194a4440e9e7856e21efd84c198

    • SHA256

      752d06bd8ff5e075fb69e52626f9983bcfeb51e5eed191ebbf7ca453bc524d1d

    • SHA512

      c6ebfa6f8a4e7aee8e74127bf714e7a6918d03daa52ea1abaa3e653baf91e6bf3ce42a7130460b98b0034c694e42705a6d4ccd3a269845640b7b5ccdfc513358

    • SSDEEP

      98304:T4R97CScENc/i//clqkMRScE1416sXHWiLLVKG:/ScENc/i//clqkMRScE1413nnkG

    Score
    10/10
    formbookbk08ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks