Overview

overview

10

Static

static

1

OriginalXS...58.rtf

windows7-x64

10

OriginalXS...58.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OriginalXShippingXDocXAW1266358.doc

  • Size

    20KB

  • Sample

    230507-k6k2rsde46

  • MD5

    ae2c3b9d62727ed548d84daf31533510

  • SHA1

    5617f74c9a760599a2083138ce7533fd2e9dca1a

  • SHA256

    6e5696451483fb3f05c8a9de86e49da1879a890d2754d0ee06f4274525befa6e

  • SHA512

    3399d87433aa27718cdf5d6008c2297deab1594cc92f20321d04c36607821c323a4e3420613b5cebaf4e22545224d92f1563d834244e13c2b27bf10b16da1096

  • SSDEEP

    384:GL0AbZSPxSCq+hvM0djWK0pw92YjBZG2rtAUAYU9DcwfQZatFi:GwAbZS5SCq+hvM0L0pw92cbG2reUJU9e

Score
10/10
formbookgtt8ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gtt8

Decoy

thesuccessbot.com

rittercivil.com

jt1.fun

d365extension.com

quqoxeq.top

visittworiverswi.com

bfprotienda.com

greenhabitsph.com

ladmere.com

clockboutiques.com

minwart.xyz

xinyuejiancai.online

eggsl.com

fetchingcandles.com

skywatiniya.com

hinkley.news

realityonlineenterprises.com

teamcroissant.com

esfera-pv.ch

herdadedosmontesbastos.com

Targets

    • Target

      OriginalXShippingXDocXAW1266358.doc

    • Size

      20KB

    • MD5

      ae2c3b9d62727ed548d84daf31533510

    • SHA1

      5617f74c9a760599a2083138ce7533fd2e9dca1a

    • SHA256

      6e5696451483fb3f05c8a9de86e49da1879a890d2754d0ee06f4274525befa6e

    • SHA512

      3399d87433aa27718cdf5d6008c2297deab1594cc92f20321d04c36607821c323a4e3420613b5cebaf4e22545224d92f1563d834244e13c2b27bf10b16da1096

    • SSDEEP

      384:GL0AbZSPxSCq+hvM0djWK0pw92YjBZG2rtAUAYU9DcwfQZatFi:GwAbZS5SCq+hvM0L0pw92cbG2reUJU9e

    Score
    10/10
    formbookgtt8ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks