Overview

overview

10

Static

static

1

8f6f20b980...86.rtf

windows7-x64

10

8f6f20b980...86.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f6f20b9800cc3739e08c986979fe886.rtf

  • Size

    27KB

  • Sample

    230608-f65zqace93

  • MD5

    8f6f20b9800cc3739e08c986979fe886

  • SHA1

    945fc5d51604afd6e92c84fac68e336680d37abc

  • SHA256

    4fe0591d0c5bd1f27e2a384aa171139b371847c545e9eae6e7bc6269a954a58b

  • SHA512

    e5a31cf4eb09b45990de61527c98a3bb5726ce52bd9b103535bb347d18e60943b1d12d73f7aec23a6b214abb0cad952aec560ccb71064b131254018ecf646b71

  • SSDEEP

    768:DHe6wuA/+TFngTG1tl2qGOQP0u2kPdU8S7C5G3fljgBQ/sp:DHOuA/+TFngC1u2kl7wm7p

Score
10/10
formbookxchuratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

xchu

Decoy

zcartoons.com

castilloshowroom.com

3bmmdtod.life

misaxoxo.com

nadiya.online

sykkbup29.xyz

triciaaprimrosevp.com

newleter.com

ptzslk.xyz

lightbulbfestival.com

texaslandline.com

ideeintemporelle.com

girljustdoitpodcast.com

medimediamarketing.com

bunk7outfitters.com

charlievgrfminnick.click

lifestyleinthehome.com

atfbestsale.online

frontdoorproperties.co.uk

grandpaswag2024.info

Targets

    • Target

      8f6f20b9800cc3739e08c986979fe886.rtf

    • Size

      27KB

    • MD5

      8f6f20b9800cc3739e08c986979fe886

    • SHA1

      945fc5d51604afd6e92c84fac68e336680d37abc

    • SHA256

      4fe0591d0c5bd1f27e2a384aa171139b371847c545e9eae6e7bc6269a954a58b

    • SHA512

      e5a31cf4eb09b45990de61527c98a3bb5726ce52bd9b103535bb347d18e60943b1d12d73f7aec23a6b214abb0cad952aec560ccb71064b131254018ecf646b71

    • SSDEEP

      768:DHe6wuA/+TFngTG1tl2qGOQP0u2kPdU8S7C5G3fljgBQ/sp:DHOuA/+TFngC1u2kl7wm7p

    Score
    10/10
    formbookxchuratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks