Overview

overview

10

Static

static

1

0d6ad8a921...57.exe

windows7-x64

10

0d6ad8a921...57.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    87f464c47591f698e28c9356315d18ba.bin

  • Size

    279KB

  • Sample

    230412-dn49cshc69

  • MD5

    42fac475365135a70da6761fe05c4261

  • SHA1

    ed45b16fbd8310bf458da95558f88ddf6201c5a8

  • SHA256

    3fe2c2deea90c1ff3996d1f49d2799669d059396033d268e5b871da902c258f8

  • SHA512

    4298e158b45bafeb70acd9fa2db0c1a66577fa09efbfc03a39944153ddde9e24018125377d38d082bcb79ed90ccdbd0127f9180b951376eb9c484f9c05a4632f

  • SSDEEP

    3072:RJggr1pUL9sLj6xO2vBMAGhU3MiOTUkFTwOap5YIUUzduM0M86rSYCQWVIoQWbnJ:Pvq9s36sEmA6KsT2OwYILz8nZQghbkY

Score
10/10
formbookguloadermi94downloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mi94

Decoy

realdigitalmarketing.co.uk

athle91.com

zetuinteriors.africa

jewelry2adore.biz

sneakersuomo.com

hotcoa.com

bestpetfinds.com

elatedfreedom.com

louisegoulet.com

licensescape.com

jenniferfalconerrealtor.com

xqan.net

textare.net

doctorlinkscsk.link

bizformspro.com

ameriealthcaritasfl.com

hanfengmeiye.com

anjin98.com

credit-cards-54889.com

dinero.news

Targets

    • Target

      0d6ad8a921c5a4bddb51d56bb7496423ceb6996526d84fff35f595ed81093a57.exe

    • Size

      295KB

    • MD5

      87f464c47591f698e28c9356315d18ba

    • SHA1

      6473b450174907216832b6a59c56e3ad65dd5ede

    • SHA256

      0d6ad8a921c5a4bddb51d56bb7496423ceb6996526d84fff35f595ed81093a57

    • SHA512

      954f1c1d930762ddb6fe37a2ee6191d4c457e86dbf0d53e0cbc42ca511cad7b00fb46bed9e8ee62e87ca9a0944730e180d668a90c71e2e3b2bce78e5c5fde576

    • SSDEEP

      6144:thtyHU2zOIngdEqGLpl4jxNlsEID49SrJz3PcF3qkQ841OJ1zHsUWw5LKm:th4z3aXrjRsEk49sPzkQ841Mlx5mm

    Score
    10/10
    formbookguloadermi94downloaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Formbook payload

      rat

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks