Overview

overview

10

Static

static

1

rBillOfQuantity.exe

windows7-x64

10

rBillOfQuantity.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rBillOfQuantity.exe

  • Size

    1018KB

  • Sample

    230329-phra4ahh2w

  • MD5

    0ac8216cb320fc7e13fbded96961c776

  • SHA1

    1329061e82e21ab844d9ce50e2c24c90d392907b

  • SHA256

    d2da367f408927aed9dc92251cc05f67a7032b9f59eafc1db59c1cc4aa71646a

  • SHA512

    2b696d2c858e75ee0a0ac73d08e9b807e811040c03f55a2c50819f2e59980c65e728fed70e8e97a17119153ec87bbd7035863f72bfa3758bc2c1ff747561983e

  • SSDEEP

    24576:U12zVZ9LpVMouvpBJpkaA0/itgYeJre6vL02Q7a:UAR3LkoCBDj0eo0Q

Score
10/10
formbookjr22ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jr22

Decoy

941zhe.com

lunarportal.space

xn--osmaniyeiek-t9ab.online

trejoscar.com

nrnursery.com

quizcannot.cfd

seedstockersthailand.com

watsonwindow.com

wjfholdings.com

weziclondon.com

naruot.xyz

yeji.plus

classicmenstore.com

oharatravel.com

therapyplankits.com

keviegreshonpt.com

qdlyner.com

seithupaarungal.com

casinorates.online

8ug4as.icu

Targets

    • Target

      rBillOfQuantity.exe

    • Size

      1018KB

    • MD5

      0ac8216cb320fc7e13fbded96961c776

    • SHA1

      1329061e82e21ab844d9ce50e2c24c90d392907b

    • SHA256

      d2da367f408927aed9dc92251cc05f67a7032b9f59eafc1db59c1cc4aa71646a

    • SHA512

      2b696d2c858e75ee0a0ac73d08e9b807e811040c03f55a2c50819f2e59980c65e728fed70e8e97a17119153ec87bbd7035863f72bfa3758bc2c1ff747561983e

    • SSDEEP

      24576:U12zVZ9LpVMouvpBJpkaA0/itgYeJre6vL02Q7a:UAR3LkoCBDj0eo0Q

    Score
    10/10
    formbookjr22ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Command-Line Interface

1
T1059

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks