Overview

overview

10

Static

static

1

Employee M...rt.vbs

windows7-x64

10

Employee M...rt.vbs

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Employee May performance report.vbs

  • Size

    21KB

  • Sample

    240611-xpr5zaxgll

  • MD5

    eea263df06eedb62e8ef52449d443147

  • SHA1

    7cdce2d9268039b378ad4aa43faa1b2f31824f2b

  • SHA256

    5d876d62f1291cfc7bf91819bd1fe4ba4da76828e7542704fd2f2605a5fa39b7

  • SHA512

    ced1a2bc7fe2bec45063b6a930bc7700502d8dfe33623e466a8917401a8f00b19ca0d37f47b0bbb15c21077c5d84b64760643a86b21f21e2d0a122d46aa829ab

  • SSDEEP

    384:QphF0OupkJEIrWJIxrDhnbJ2JsEk2ZMPc6q:QphiOupkJRWJIxrlbQGElZMk6q

Score
10/10
formbookguloaderty31downloaderexecutionpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ty31

Decoy

jejakunik.com

inb319.com

jifsjn.buzz

gkyukon.site

43443.cfd

cogil69id.com

oeaog.com

lpgatm.com

mymarketsales.com

tomclk.icu

404417.online

nysconstruction.com

ourwisequote.com

ahsanadvisory.com

ottawaherps.com

forevermust.com

apartments-for-rent-47679.bond

kdasjijaksdd.icu

buthaynah.com

manggungjayakanopi.com

Targets

    • Target

      Employee May performance report.vbs

    • Size

      21KB

    • MD5

      eea263df06eedb62e8ef52449d443147

    • SHA1

      7cdce2d9268039b378ad4aa43faa1b2f31824f2b

    • SHA256

      5d876d62f1291cfc7bf91819bd1fe4ba4da76828e7542704fd2f2605a5fa39b7

    • SHA512

      ced1a2bc7fe2bec45063b6a930bc7700502d8dfe33623e466a8917401a8f00b19ca0d37f47b0bbb15c21077c5d84b64760643a86b21f21e2d0a122d46aa829ab

    • SSDEEP

      384:QphF0OupkJEIrWJIxrDhnbJ2JsEk2ZMPc6q:QphiOupkJRWJIxrlbQGElZMk6q

    Score
    10/10
    formbookguloaderty31downloaderexecutionpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Formbook payload

      rat

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks