Overview

overview

10

Static

static

3

nfattura s...df.exe

windows7-x64

10

nfattura s...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    nfattura scaduta Pdf.exe.xz

  • Size

    1.1MB

  • Sample

    230726-p4mj2abd66

  • MD5

    7e3bac2b62f1cbe305e1ac8281969125

  • SHA1

    7185b30bb42a7907c30a93dd345646ed8f694fd2

  • SHA256

    b8ce7b8f60bb42477ea6bba328bfd310cfec0c1ebbc1f60ce4b2571e240d9d57

  • SHA512

    96de9b9a34f1f2769508940dae3923e551e274f79d626970fc2c20d96d63246e0aee7ac1599cbd1225eb904b421b7c7e1c2ffa33e9f9cbe5f5e2b2d7cfc78924

  • SSDEEP

    24576:/KeEuyabQw5jTlkclAu8MbYalgYOCcvBVtOJA51wPKLRuxAyH2k2GlOPdWs4bJ:hEkN5fMFmXWYlcvBVt2FyLRuxXWGlOla

Score
10/10
formbookmodiloaderges9persistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ges9

Decoy

lolofestival.store

amzin.info

pulsahokii.xyz

bahiszirve.com

animekoe.com

kansastaxaccountant.net

howgoodisgod.online

medakaravan.xyz

pesmagazine.net

americanpopulist.info

nepalihandicraft.com

mariabakermodeling.com

cavify.top

onlinewoonboulevard.com

furniture-22830.com

ophthalmicpersonneltraining.us

yz1204.com

extrawhite.site

tomo.store

martfind.online

Targets

    • Target

      nfattura scaduta Pdf.exe

    • Size

      1.5MB

    • MD5

      0d4b25a33c69e4443f28a43ae3b015c9

    • SHA1

      92267c25dc62805bdfff9497174bf91feec90f2c

    • SHA256

      869eb1b44b9d5e0ee5b99b1189edd21d706c58094387ba32ebf2aa45703a9c9b

    • SHA512

      f628aaa5e739534b6e7833f44ca96e3a83dc83aac026b0f75c3919e937ed468d18764f1b2347995822e98d3eb6c6797524c0c28d4c6371f3a9c57dab0eac9e1f

    • SSDEEP

      24576:rbGHGrOrQ9gnMC6LO3cQoikKgti8PM2MCUrTDLwVIf2IOXkDtZ3NptsNbJZ:rbGWAJeDingti8P+TwSNO0n9vwbJZ

    Score
    10/10
    modiloadertrojanformbookges9persistenceratspywarestealer

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Suspicious use of NtCreateProcessOtherParentProcess

    • Formbook payload

      rat

    • ModiLoader Second Stage

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks