Overview

overview

10

Static

static

3

Olağanüs...me.exe

windows7-x64

10

Olağanüs...me.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Olağanüstü ödeme.exe

  • Size

    964KB

  • Sample

    240418-l43pgahh56

  • MD5

    ad400a4c8af415892429acb5886a5ee7

  • SHA1

    bd6c023606236c1ccb74863680ca5e74029d3526

  • SHA256

    81f6e3ff9cc821300e30acd628d0579793806ebfb89941d04f9bc33998f9a851

  • SHA512

    977239ebaf324f3409c5cac7fae2163004298ae63cd2a470df3be0256a6d60ffa8c9cd46e72bbbdbef89c91ebaa9122dd9663ed49970df9dc03f1b446b97e5a1

  • SSDEEP

    12288:eYsoBukMEbli8FwgY3zpQ43W/2bsJQG6JETe6dMM9DsMORFYNL8jWiqt+uIfHKdO:3sKlCgGU2QBoETe6u2DiRGJDiq4fHK4

Score
10/10
formbookgs12ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gs12

Decoy

juniavilela.com

italiahealth.club

freefoodpro.com

qqmotor.co

mosahacatering.com

wocc.club

tourly360.com

airzf.com

eternalknot1008.com

pons.cc

zdryueva.com

bodution.website

vip8g100013.top

3box.club

bestoffersinoneplace.com

tronbank.club

hlysh.live

allfireofferapp.sbs

goldenvistaservices.com

theconfidencebl-youprint.com

Targets

    • Target

      Olağanüstü ödeme.exe

    • Size

      964KB

    • MD5

      ad400a4c8af415892429acb5886a5ee7

    • SHA1

      bd6c023606236c1ccb74863680ca5e74029d3526

    • SHA256

      81f6e3ff9cc821300e30acd628d0579793806ebfb89941d04f9bc33998f9a851

    • SHA512

      977239ebaf324f3409c5cac7fae2163004298ae63cd2a470df3be0256a6d60ffa8c9cd46e72bbbdbef89c91ebaa9122dd9663ed49970df9dc03f1b446b97e5a1

    • SSDEEP

      12288:eYsoBukMEbli8FwgY3zpQ43W/2bsJQG6JETe6dMM9DsMORFYNL8jWiqt+uIfHKdO:3sKlCgGU2QBoETe6u2DiRGJDiq4fHK4

    Score
    10/10
    formbookgs12ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks