Overview

overview

10

Static

static

Acount Det...om.exe

windows7_x64

7

Acount Det...om.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Acount Details.com

  • Size

    291KB

  • Sample

    200630-6am4ep5ala

  • MD5

    d15fc838aacf85c873bca9adfe7b9997

  • SHA1

    43ff525b542d1e73c4345fd3312788876cf422a5

  • SHA256

    abdae1b1965bafd334bb46028ddeffc82d495bf84aaa3f44403d9a17963f12c5

  • SHA512

    831e8bb86b3fb42a678052db8c8d703546320525cfd211d51b7dea56abeddb0a4ecfa37f45de3543768db784eee15d70bd7033906b1ecc31fa0019744cd5f92f

Score
10/10
formbookpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      Acount Details.com

    • Size

      291KB

    • MD5

      d15fc838aacf85c873bca9adfe7b9997

    • SHA1

      43ff525b542d1e73c4345fd3312788876cf422a5

    • SHA256

      abdae1b1965bafd334bb46028ddeffc82d495bf84aaa3f44403d9a17963f12c5

    • SHA512

      831e8bb86b3fb42a678052db8c8d703546320525cfd211d51b7dea56abeddb0a4ecfa37f45de3543768db784eee15d70bd7033906b1ecc31fa0019744cd5f92f

    Score
    10/10
    persistencespywaretrojanstealerformbook

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Adds Run entry to policy start application

      persistence

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks