General
- Target S26000352.exe
- Size 176KB
- Sample260623-qd4ajac19w
- SHA256 8bda7db9909e9b4e6bbb325102bae2639f622cf3d895e1b500f7a02cfd21608d
Malware Config
Targets
-
- Target S26000352.exe
- Size 176KB
- SHA256 8bda7db9909e9b4e6bbb325102bae2639f622cf3d895e1b500f7a02cfd21608d
Score10/10-
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
Score3/10 -
- Target Lp/formspndt.unt
- Size 41KB
- SHA256 3ee6c1e6f5adcceaa37bcd45821a28ce7c86d385dc5abda8009045b3afe2aba1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Lp/grinagtigt.his
- Size 48KB
- SHA256 625521af0b4e478931a211001330911c077bc002ad4392e73edbb5ee80f769dc
Score3/10 -
- Target Lp/ndsituationer.hrg
- Size 58KB
- SHA256 304ff482da5b05c502a65457eca87b6ff9fa4b0ddc585ecc2a81a728593281bd
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Lp/preparatively.ove
- Size 26KB
- SHA256 5964d660fc8745c75e8b9515d851e4dfa083f03f51f395b55b70b92bae900ee2
Score3/10 -
- Target Lp/swarmers.inh
- Size 2KB
- SHA256 76d443cfbc0718d351a7bcd387c847ba7a0ea0e4cd3fe7a53c238a22421efcc6
Score3/10 -
- Target Saddeltagets226.typ
- Size 49KB
- SHA256 d44279553e2df9b0e77ddeb77f51988031fd34658c6ca9f3b0286f5390b2f082
Score3/10 -
- Target Scapegoating.bar
- Size 8KB
- SHA256 affa537fd0755036e9669c739d694c99ee1d072434dd2c495247869018bc7b90
Score3/10 -
- Target Youngly
- Size 35KB
- SHA256 79da9fbc991e637705bac5bb6dbc3b6ae5ba90773d83c4fa36a2ca74f75f0ff0
Score1/10 -
- Target coequalness.bil
- Size 5KB
- SHA256 280d229745e9bc3a80d1c5d6ea86167fb3f78ce37ed9f0b5ad26165a85ebfe8e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target dataskrm.bio
- Size 5KB
- SHA256 a0332d36644105e5a2e4e6054a42e4cca324cfa234633c4b869522be35a7c5d0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target detoneringers.syg
- Size 40KB
- SHA256 90b4964e775b1179ee11b90c9c3063f8ef13109ba893ea1a899d602d2519986f
Score3/10 -
- Target hemmeligstemple
- Size 119KB
- SHA256 ccbfc42bd474a5d8b7822d6a2226afac915371a875e428a306861f23656d497d
Score1/10