Overview

overview

10

Static

static

3

40df500e4c...0d.exe

windows7-x64

10

40df500e4c...0d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    40df500e4caa9265ef6bea269c34140d.exe

  • Size

    662KB

  • Sample

    230627-ffnyhsea3x

  • MD5

    40df500e4caa9265ef6bea269c34140d

  • SHA1

    db34bb2e6dc20b945443faa9f5c5607a66638735

  • SHA256

    9e4d05b5c07d77f2bf1fd7a22c59b4932f096ad1e140a536a025b5c325683073

  • SHA512

    d51a238be322f12673fa76be731a123a2d0ca5c398a285e91a7a5bed231f4f1d5ca27e3ee0d4bd83502a064dec537a56fe9ed3f578c1e2e1595df8b7f2c7a347

  • SSDEEP

    12288:a5dPG2fJ4owKoZ4Ra6SeLDIRh+iq41d+RfgCyVN:yJ5oZ4Ra6SeXwA+d+FghV

Score
10/10
formbookxchuratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

xchu

Decoy

zcartoons.com

castilloshowroom.com

3bmmdtod.life

misaxoxo.com

nadiya.online

sykkbup29.xyz

triciaaprimrosevp.com

newleter.com

ptzslk.xyz

lightbulbfestival.com

texaslandline.com

ideeintemporelle.com

girljustdoitpodcast.com

medimediamarketing.com

bunk7outfitters.com

charlievgrfminnick.click

lifestyleinthehome.com

atfbestsale.online

frontdoorproperties.co.uk

grandpaswag2024.info

Targets

    • Target

      40df500e4caa9265ef6bea269c34140d.exe

    • Size

      662KB

    • MD5

      40df500e4caa9265ef6bea269c34140d

    • SHA1

      db34bb2e6dc20b945443faa9f5c5607a66638735

    • SHA256

      9e4d05b5c07d77f2bf1fd7a22c59b4932f096ad1e140a536a025b5c325683073

    • SHA512

      d51a238be322f12673fa76be731a123a2d0ca5c398a285e91a7a5bed231f4f1d5ca27e3ee0d4bd83502a064dec537a56fe9ed3f578c1e2e1595df8b7f2c7a347

    • SSDEEP

      12288:a5dPG2fJ4owKoZ4Ra6SeLDIRh+iq41d+RfgCyVN:yJ5oZ4Ra6SeXwA+d+FghV

    Score
    10/10
    formbookxchuratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks