Overview

overview

10

Static

static

3

PI.exe

windows7-x64

10

PI.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PI.rar

  • Size

    510KB

  • Sample

    230519-f79z3aeb4x

  • MD5

    2f10e089d44959bb959a752301b6edda

  • SHA1

    a01e1ac45690b839ec30fc45d01e9cd6880579a4

  • SHA256

    e2022f8fdaec009f0a0cbf8cf3b248854c065312c43a18ae0bb61113b7d8f66c

  • SHA512

    fa7b17d3caee8496ed68c71c502edbfbb449e1944850f4e86ce8f41994a2143bd0207cfffe3d7f1c5a52d3636e5cebcb5ead44581400c450ddd7405e84b5b2a7

  • SSDEEP

    12288:LKSkF7teaQfuN735mUTcu4v8Vi6ejuZnJUC+v7:HkRteaQmN7pfI70VijjuZnJWv7

Score
10/10
formbookm82ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m82

Decoy

jamesdevereux.com

artificialturfminneapolis.com

hongmeiyan.com

lojaderoupasbr.com

yit.africa

austinrelocationexpert.com

saiva.page

exitsategy.com

chochonux.com

klosterbraeu-unterliezheim.com

byseymanur.com

sblwarwickshire.co.uk

brazimaid.com

ciogame.com

bronzesailing.com

dwkapl.xyz

022dyd.com

compassandpathwriting.com

alphabet1x.com

selfcleaninghairbrush.co.uk

Targets

    • Target

      PI.exe

    • Size

      640KB

    • MD5

      24f7d407a7eff2ea62af53f7c11f2fb0

    • SHA1

      d4b3db48383aba71c1ef461f84a7e001689187e7

    • SHA256

      a28cb539852da2e100484ab8cee9613a28b2e68d409b99d80e27f4fb7f238b5d

    • SHA512

      5d4095656b6981718fcbc82852d9cb20d73e3314d98d6cf8230c068f149e053f9000d180c8abbc98f8367282441d6c03bf140db9888495502b8b504f15527b0e

    • SSDEEP

      6144:kdR80E2s4y3+3gXKuS8qc863OBV+7SUSqtiTP8jyNBaK+vsy37G3Nt1yPg1ChsXX:12zKYCKuS8tOqdRCzso1Chsboc

    Score
    10/10
    formbookm82ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks