Overview

overview

10

Static

static

3

lhDCR5RvXwLbWQu.exe

windows7-x64

10

lhDCR5RvXwLbWQu.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    lhDCR5RvXwLbWQu.exe

  • Size

    903KB

  • Sample

    240620-g2lkystbqe

  • MD5

    66bbfd82c0b1bdd60dca1d71945b42c2

  • SHA1

    467d4125a380f1672983c51f1a4706f039b890af

  • SHA256

    780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5

  • SHA512

    ca85a5e898139ad5e437a66c99baee9c8408773a214d37df02bad4388f8d5ab30cb240985b8869c1e36d971c9615da236e90de20d3a3e091b13caded01fa2bbf

  • SSDEEP

    12288:4SiJkBoxXIFykQzrAVZK3B6xNYUCSPGnsV9nJyJ+XwrwILkz4ZTyrhbjjq5jCkj4:37wWg4NtCSPGGkUNW2rJjq5uM4

Score
10/10
formbookdy13ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dy13

Decoy

manga-house.com

kjsdhklssk51.xyz

b0ba138.xyz

bt365033.com

ccbsinc.net

mrwine.xyz

nrxkrd527o.xyz

hoshi.social

1912ai.com

serco2020.com

byfchfyr.xyz

imuschestvostorgov.online

austinheafey.com

mrdfa.club

883106.photos

profitablefxmarkets.com

taini00.net

brye.top

ginsm.com

sportglid.com

Targets

    • Target

      lhDCR5RvXwLbWQu.exe

    • Size

      903KB

    • MD5

      66bbfd82c0b1bdd60dca1d71945b42c2

    • SHA1

      467d4125a380f1672983c51f1a4706f039b890af

    • SHA256

      780c4d3a33c89cd911190c17d7ba3ad69e5ddc66396762e4bef8ff67bd45b7b5

    • SHA512

      ca85a5e898139ad5e437a66c99baee9c8408773a214d37df02bad4388f8d5ab30cb240985b8869c1e36d971c9615da236e90de20d3a3e091b13caded01fa2bbf

    • SSDEEP

      12288:4SiJkBoxXIFykQzrAVZK3B6xNYUCSPGnsV9nJyJ+XwrwILkz4ZTyrhbjjq5jCkj4:37wWg4NtCSPGGkUNW2rJjq5uM4

    Score
    10/10
    formbookdy13ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks