Overview

overview

10

Static

static

3

fe55ce9692...d4.exe

windows7-x64

10

fe55ce9692...d4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fe55ce9692454e2449322576708c5ca42f335d9fb73f9daa605599e9e2ab4dd4.exe

  • Size

    670KB

  • Sample

    240611-b32qnsyhlg

  • MD5

    590b5eb75c4572a426d2b6a58951eeb9

  • SHA1

    d5a3cadb0b9ce83d9c86c044ce5c34f565c2e4e2

  • SHA256

    fe55ce9692454e2449322576708c5ca42f335d9fb73f9daa605599e9e2ab4dd4

  • SHA512

    bf3dfae9677795afa40f1b7d65144e25aeb15ad020f4d50b8ea9c578ebcf790215b3afe9a52711fc9ca716b21386f4edae966962464cb7c216c2245eb2902f7e

  • SSDEEP

    12288:FrSINW2pFKuYFPLJB/LpW8QxNPza/BrM+tK+CVINoX9yKBg7vj:FrSWbKRoiC9yKe/

Score
10/10
formbookij84ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ij84

Decoy

resetter.xyz

simonbelanger.me

kwip.xyz

7dbb9.baby

notion-everyday.com

saftiwall.com

pulse-gaming.com

fafafa1.shop

ihaveahole.com

sxtzzj.com

996688x.xyz

komalili.monster

haberdashere.store

nurselifegng.com

kidtryz.com

ghvx.xyz

1minvideopro.com

hidef.group

stylishbeststyler.space

spx21.com

Targets

    • Target

      fe55ce9692454e2449322576708c5ca42f335d9fb73f9daa605599e9e2ab4dd4.exe

    • Size

      670KB

    • MD5

      590b5eb75c4572a426d2b6a58951eeb9

    • SHA1

      d5a3cadb0b9ce83d9c86c044ce5c34f565c2e4e2

    • SHA256

      fe55ce9692454e2449322576708c5ca42f335d9fb73f9daa605599e9e2ab4dd4

    • SHA512

      bf3dfae9677795afa40f1b7d65144e25aeb15ad020f4d50b8ea9c578ebcf790215b3afe9a52711fc9ca716b21386f4edae966962464cb7c216c2245eb2902f7e

    • SSDEEP

      12288:FrSINW2pFKuYFPLJB/LpW8QxNPza/BrM+tK+CVINoX9yKBg7vj:FrSWbKRoiC9yKe/

    Score
    10/10
    formbookij84ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks