formbook | 0fda16a373440fc97605138e9d55cc140f75d85fcd3d420ea8df9b87172d51e6 | Triage

Sharing

General

Target

Ubevijukroxyde.exe
Size

2.2MB
Sample

231127-1ba63sda93
MD5

06d1edbba5f83a0f13ca656672556f65
SHA1

488b0ea60f9bf48a422812d7fa509c3f604766f7
SHA256

0fda16a373440fc97605138e9d55cc140f75d85fcd3d420ea8df9b87172d51e6
SHA512

7c8cc3836aef04ced7fccae6ba1665f923b5c2e680b4b337a6b5ec523702c75972064d3ba6007de97cd2f60b1fa36d70b478c1ad15e9e52eb9097403a4babf0c
SSDEEP

49152:JWPpH8yc0/wU2lpe63ZrxKrVEbRIqiPt41JFehg1mQmPoE:JCpcyV/wjpdZrxEVEtI145qnLPoE

Score

10^/10

formbook modiloader ao65 persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ao65

Decoy

spins2023.pro

foodontario.com

jsnmz.com

canwealljustagree.com

shopthedivine.store

thelakahealth.com

kuis-raja-borong.website

hbqc2.com

optimusvisionlb.com

urdulatest.com

akhayarplus.com

info-antai-service.com

kermisbedrijfkramer.online

epansion.com

gxqingmeng.top

maltsky.net

ictwath.com

sharmafootcare.com

mycheese.net

portfoliotestkitchen.com

Targets

- Target
  
  Ubevijukroxyde.exe
- Size
  
  2.2MB
- MD5
  
  06d1edbba5f83a0f13ca656672556f65
- SHA1
  
  488b0ea60f9bf48a422812d7fa509c3f604766f7
- SHA256
  
  0fda16a373440fc97605138e9d55cc140f75d85fcd3d420ea8df9b87172d51e6
- SHA512
  
  7c8cc3836aef04ced7fccae6ba1665f923b5c2e680b4b337a6b5ec523702c75972064d3ba6007de97cd2f60b1fa36d70b478c1ad15e9e52eb9097403a4babf0c
- SSDEEP
  
  49152:JWPpH8yc0/wU2lpe63ZrxKrVEbRIqiPt41JFehg1mQmPoE:JCpcyV/wjpdZrxEVEtI145qnLPoE
Score

10^/10

modiloader trojan formbook ao65 persistence rat spyware stealer
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Formbook payload
  rat
- ModiLoader Second Stage
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

modiloadertrojan

behavioral2

formbookmodiloaderao65persistenceratspywarestealertrojan