Overview

overview

10

Static

static

1

Цитата.exe

windows7-x64

10

Цитата.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Цитата.exe

  • Size

    562KB

  • Sample

    240522-jv38jagh89

  • MD5

    84144b6048277290bb6eb647bbc5ad2a

  • SHA1

    609a26e95e4b343bfb47ab51bdd68ef9a8ef791f

  • SHA256

    151bfa7336a9c96e65bf8a0eeb54a3d34665e612c8c5b3a7886f16a6f58277c4

  • SHA512

    792f0c22ed8aef3766f773f4c49698e9d2d2678191c98493e83076fa90dc8a83d67cdd00fe46d7409b4eeb1539c542cd0219b4b9121d45ecbb0ec0ac3bd94baa

  • SSDEEP

    12288:R+vLWa44/RYO83ksdpiVRkvZU08wvzTIVodNgvBqk0WFLehfK2iE3LKvmbrJ:E44/Ky7MN7LT4vBqkle1FPbKSd

Score
10/10
formbookgy14persistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gy14

Decoy

mavbam.com

theanhedonia.com

budgetnurseries.com

buflitr.com

alqamarhotel.com

2660348.top

123bu6.shop

v72999.com

yzyz841.xyz

247fracing.com

naples.beauty

twinklethrive.com

loscaseros.com

creditspisatylegko.site

sgyy3ej2dgwesb5.com

ufocafe.net

techn9nehollywoodundead.com

truedatalab.com

alterdpxlmarketing.com

harborspringsfire.com

Targets

    • Target

      Цитата.exe

    • Size

      562KB

    • MD5

      84144b6048277290bb6eb647bbc5ad2a

    • SHA1

      609a26e95e4b343bfb47ab51bdd68ef9a8ef791f

    • SHA256

      151bfa7336a9c96e65bf8a0eeb54a3d34665e612c8c5b3a7886f16a6f58277c4

    • SHA512

      792f0c22ed8aef3766f773f4c49698e9d2d2678191c98493e83076fa90dc8a83d67cdd00fe46d7409b4eeb1539c542cd0219b4b9121d45ecbb0ec0ac3bd94baa

    • SSDEEP

      12288:R+vLWa44/RYO83ksdpiVRkvZU08wvzTIVodNgvBqk0WFLehfK2iE3LKvmbrJ:E44/Ky7MN7LT4vBqkle1FPbKSd

    Score
    10/10
    formbookgy14persistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Adds policy Run key to start application

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

3
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks