Overview

overview

10

Static

static

1

PaymentDetails.rtf

windows7-x64

10

PaymentDetails.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PaymentDetails.doc

  • Size

    31KB

  • Sample

    230507-k6vk7sfc9w

  • MD5

    fd5e7dec877d40fb79fb78ab877680c7

  • SHA1

    51a42299563697d0b90727f61e82bef04f76316e

  • SHA256

    85a9c86962ea71b53cd5dfd7bb8aa43a4556b131ba2bf96ac54a430591e2c833

  • SHA512

    182abd66fae177520b7dd0709d374c72c33e98f633b3a0079b08e91e7743d88e665e44c21a0ee6895f1ed762aff084c465c743fd3cd7351e3fe2da2560e42d22

  • SSDEEP

    768:UFx0XaIsnPRIa4fwJMyIyTxwi9vQk3lD73RHA/FCrglMF+C:Uf0Xvx3EMyIG9VH8CrqMFT

Score
10/10
formbookgtt8ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gtt8

Decoy

thesuccessbot.com

rittercivil.com

jt1.fun

d365extension.com

quqoxeq.top

visittworiverswi.com

bfprotienda.com

greenhabitsph.com

ladmere.com

clockboutiques.com

minwart.xyz

xinyuejiancai.online

eggsl.com

fetchingcandles.com

skywatiniya.com

hinkley.news

realityonlineenterprises.com

teamcroissant.com

esfera-pv.ch

herdadedosmontesbastos.com

Targets

    • Target

      PaymentDetails.doc

    • Size

      31KB

    • MD5

      fd5e7dec877d40fb79fb78ab877680c7

    • SHA1

      51a42299563697d0b90727f61e82bef04f76316e

    • SHA256

      85a9c86962ea71b53cd5dfd7bb8aa43a4556b131ba2bf96ac54a430591e2c833

    • SHA512

      182abd66fae177520b7dd0709d374c72c33e98f633b3a0079b08e91e7743d88e665e44c21a0ee6895f1ed762aff084c465c743fd3cd7351e3fe2da2560e42d22

    • SSDEEP

      768:UFx0XaIsnPRIa4fwJMyIyTxwi9vQk3lD73RHA/FCrglMF+C:Uf0Xvx3EMyIG9VH8CrqMFT

    Score
    10/10
    formbookgtt8ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks