Overview

overview

10

Static

static

1

qoutation2103.exe

windows7-x64

10

qoutation2103.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    qoutation2103.exe

  • Size

    1.1MB

  • Sample

    230322-ltwheaaa7w

  • MD5

    e66d6f5532594ddd9ec4cf105bf0604f

  • SHA1

    977c34a809bc4a5709e4e9a5d593f1b7aab304a5

  • SHA256

    d6cb7358c0741c5f1e50c5d8fef2423d960345a59e722a88d852049a9226811e

  • SHA512

    caa6c6fd60dd5a4253f9a08f3ff21c0a67e89711935a49151938a13bb0667018d6cdb4572df08583a69f1a09d720c3c9fbb5270d95d66ad4cd656315a54bee16

  • SSDEEP

    24576:NTbBv5rUanRE0kd8HdMKMIyTxxmm/FpXwF+XgOPo+clHi:HBjcdAd3kV/FpW+XgOA7s

Score
10/10
formbookmg24persistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mg24

Decoy

jhae3jp.store

generalfirstaidcourse.com

breville-accounting.com

homeinthehamptonsny.com

amphibiamerch.store

lagosstateteacherawards.africa

955.global

longmaosh.com

crblwks.com

horliga.co.uk

classicdancehitzofficial.com

crytodefi.online

huachunjianshe-sh.com

hotel-la-cascada.xyz

avastate.com

cheapweedseeds.com

abgroupthailand.com

context-switching.com

drsolarshine.site

nxeliz.xyz

Targets

    • Target

      qoutation2103.exe

    • Size

      1.1MB

    • MD5

      e66d6f5532594ddd9ec4cf105bf0604f

    • SHA1

      977c34a809bc4a5709e4e9a5d593f1b7aab304a5

    • SHA256

      d6cb7358c0741c5f1e50c5d8fef2423d960345a59e722a88d852049a9226811e

    • SHA512

      caa6c6fd60dd5a4253f9a08f3ff21c0a67e89711935a49151938a13bb0667018d6cdb4572df08583a69f1a09d720c3c9fbb5270d95d66ad4cd656315a54bee16

    • SSDEEP

      24576:NTbBv5rUanRE0kd8HdMKMIyTxxmm/FpXwF+XgOPo+clHi:HBjcdAd3kV/FpW+XgOA7s

    Score
    10/10
    formbookmg24persistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks