Overview

overview

10

Static

static

3

bd90dba924...84.exe

windows7-x64

10

bd90dba924...84.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bd90dba924ee14fc81a245124d6e9b425b290f83cd793f76573b1408ebf5f284.exe

  • Size

    664KB

  • Sample

    240521-b1qwdsea29

  • MD5

    316d52ffa3e819ca0afe9c8c70e93eee

  • SHA1

    136f3ed7b097d9af4046c7119c0f8856c67df474

  • SHA256

    bd90dba924ee14fc81a245124d6e9b425b290f83cd793f76573b1408ebf5f284

  • SHA512

    bbca5419b73df55e068e42fa86702313a7843daa846f18aa41437fba21992cc07c6aa30bbbf641582765648bfe617afd8e7f361f95d6bb14447752da543f8952

  • SSDEEP

    12288:nJEasCzbd0aBJHAKoumkG7yC9AhPhakJzJGMjta9c3kOdJhC+mugBY:7sVCgQA9LyJGMJT0c09

Score
10/10
formbookpz12executionratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pz12

Decoy

paucanyes.com

autonwheels.com

cowboysandcaviarbar.com

fitnessengineeredworkouts.com

nuevobajonfavorito.com

dflx8.com

rothability.com

sxybet88.com

onesource.live

brenjitu1904.com

airdrop-zero1labs.com

guangdongqiangzhetc.com

apartments-for-rent-72254.bond

ombak99.lol

qqfoodsolutions.com

kyyzz.com

thepicklematch.com

ainth.com

missorris.com

gabbygomez.com

Targets

    • Target

      bd90dba924ee14fc81a245124d6e9b425b290f83cd793f76573b1408ebf5f284.exe

    • Size

      664KB

    • MD5

      316d52ffa3e819ca0afe9c8c70e93eee

    • SHA1

      136f3ed7b097d9af4046c7119c0f8856c67df474

    • SHA256

      bd90dba924ee14fc81a245124d6e9b425b290f83cd793f76573b1408ebf5f284

    • SHA512

      bbca5419b73df55e068e42fa86702313a7843daa846f18aa41437fba21992cc07c6aa30bbbf641582765648bfe617afd8e7f361f95d6bb14447752da543f8952

    • SSDEEP

      12288:nJEasCzbd0aBJHAKoumkG7yC9AhPhakJzJGMjta9c3kOdJhC+mugBY:7sVCgQA9LyJGMJT0c09

    Score
    10/10
    formbookpz12executionratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks