Overview

overview

10

Static

static

1

04a5e2c14d...66.rtf

windows7-x64

10

04a5e2c14d...66.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9cf9b2689e9cf1828198509df38ed707.bin

  • Size

    14KB

  • Sample

    230328-ch78dsac5z

  • MD5

    21e8059580b23f245a9a0657cb09ee37

  • SHA1

    1b14ca20119c8e314c15b301601613b24f3484cf

  • SHA256

    549cf0674e0f90338ace9a01809c66c7884447507d62dc6de9c8b1547f0e42a8

  • SHA512

    44a7cc2379615ec4a606fed679f0058b1ce8d446bf65255e7a90074252962f28b63488a74a117c684e7bc1e35f1858f51fb334d6e3d364e1a23a3c6a456a1b0e

  • SSDEEP

    384:rBuocSb3w9aJDSD2ZqlS+lonLPR7I1XfOiazU:rBuy3gIsCqlS+KLPR7YXfORU

Score
10/10
formbookdr62ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dr62

Decoy

juanbrujo.com

toptasker.africa

g-labs.one

1redbuckpermonth.com

lasolutions.online

beginagainmen.com

iearn.site

leading-car.ru

codigosindiabetes.fun

6y8ud.bond

fptmarket.shop

ctjhxv3.vip

huluxia2.xyz

piggg08.uk

kms-pico-tools.com

westonandcate.com

giftrendz.com

kqwdhrendfywefdst.top

anchitchoudhary.com

sistemodasi.net

Targets

    • Target

      04a5e2c14d7f9d46c5eac57ea70040bbe1e4215205b6f616b125463c3bb7a466.bin

    • Size

      29KB

    • MD5

      9cf9b2689e9cf1828198509df38ed707

    • SHA1

      cd3687a2aed2c33ac8194d18fdd9ec31f854a59a

    • SHA256

      04a5e2c14d7f9d46c5eac57ea70040bbe1e4215205b6f616b125463c3bb7a466

    • SHA512

      68e66d3dad87d99619e96976eadc61a55c5c0f93cc373a9ef1569d94c0b81b9306dcfbedd025a99bef982c6b9a783f6c43bd687748cfdb5ed64d3168030ba86d

    • SSDEEP

      768:BFx0XaIsnPRIa4fwJMXDICAhPjIJot1LnHWuTES:Bf0Xvx3EMzIh1jIOLbt

    Score
    10/10
    formbookdr62ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks