Overview

overview

10

Static

static

1

85259a321d...10.exe

windows7-x64

10

85259a321d...10.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    78a95a8cb18e37d6565520be5e8013c4.bin

  • Size

    247KB

  • Sample

    230324-b5jb4sde2v

  • MD5

    3cef13fe32e6b3f4072bc477da53982b

  • SHA1

    4348c915c2755fcd08e299b750d0b0efe9060580

  • SHA256

    759db6bfd380f5056e9ce9e9199b91c37ff48e6d6306666d4ac4ec61fa9fc1f0

  • SHA512

    5a33b71d3570dfd49b899df7b588bb47daa826b650d42c2af832b54d064a9d92849f479b996c335291044f1a90ec67ef64a88cfff124c45dfec6e16ecab77c20

  • SSDEEP

    6144:4twOUBOVpmCdzqiFiYJqRZKpQ/mxP239Kt7AU85VMl:4twOUAVQRUJqR423J52

Score
10/10
formbookbn26ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bn26

Decoy

juweipai.com

assurance-mon-espace-sante.com

robqq.com

ablindear.com

socialmonkeys.co.uk

learningworldtech.com

imprese-it.com

themoodcollectives.africa

lutonmethodists.org.uk

castawaycovebnb.com

caronthemove.com

carolinacastro.uk

dcfashionweekintl.com

branchbasicsa.com

drpatrickakinsanya.africa

inventourownfuture.com

applege.top

whatamitiredof.com

daphan.pics

gardenstatevinyl.net

Targets

    • Target

      85259a321d6b1d54bae58397546222f0cf4584467240f0cbcdb7445577b66510.exe

    • Size

      286KB

    • MD5

      78a95a8cb18e37d6565520be5e8013c4

    • SHA1

      36557486465d9d133f2ea5aceaec9731f0663f91

    • SHA256

      85259a321d6b1d54bae58397546222f0cf4584467240f0cbcdb7445577b66510

    • SHA512

      7a811797afff6e82082296a10e5f3135340f126d1230bc15983737c0363c082b8bf7651d0732d85f89c5d08e13177fed789851c6402444c4dc794ee68d90be44

    • SSDEEP

      6144:AYa66rPn6SbiaFiPvZNU2tpErTwf4ceMXIECWoqgruCRnMti4oZQ:AYsrPn6Mia4PXU2tpswfx4WvCRwoZQ

    Score
    10/10
    formbookbn26ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks