Overview

overview

10

Static

static

5

8973790929...ee.exe

windows7-x64

10

8973790929...ee.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8973790929fbbd34ff29fb50b887dec10d68f8fcefc5050d6ec78dc88a64b5ee.exe

  • Size

    1.1MB

  • Sample

    240622-bq6h4azhle

  • MD5

    45559d099e47318b998071ce98c83ac9

  • SHA1

    86556702141afe1888663f3aefd4eaeae8800579

  • SHA256

    8973790929fbbd34ff29fb50b887dec10d68f8fcefc5050d6ec78dc88a64b5ee

  • SHA512

    513a69fd7677e5abeefc8514c49a2daf2a073b7a1bd1396997eae31342294c8eb7bfbfad69a7f357ec624c15150d9a4d5c71f8ce44b15827bfcdb13e502379bd

  • SSDEEP

    24576:OAHnh+eWsN3skA4RV1Hom2KXMmHazRgNMfM6hkjVQPn75:5h+ZkldoPK8YazqNMk6h2VQP9

Score
10/10
formbookrn94ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rn94

Decoy

st68v.xyz

conciergenotary.net

qwechaotk.top

rtpdonatoto29.xyz

8ad.xyz

powermove.top

cameras-30514.bond

vanguardcoffee.shop

umoe53fxc1bsujv.buzz

consultoriamax.net

hplxx.com

ndu.wtf

yzh478c.xyz

bigbrown999.site

xiake07.asia

resdai.xyz

the35678.shop

ba6rf.rest

ceo688.com

phimxhot.xyz

Targets

    • Target

      8973790929fbbd34ff29fb50b887dec10d68f8fcefc5050d6ec78dc88a64b5ee.exe

    • Size

      1.1MB

    • MD5

      45559d099e47318b998071ce98c83ac9

    • SHA1

      86556702141afe1888663f3aefd4eaeae8800579

    • SHA256

      8973790929fbbd34ff29fb50b887dec10d68f8fcefc5050d6ec78dc88a64b5ee

    • SHA512

      513a69fd7677e5abeefc8514c49a2daf2a073b7a1bd1396997eae31342294c8eb7bfbfad69a7f357ec624c15150d9a4d5c71f8ce44b15827bfcdb13e502379bd

    • SSDEEP

      24576:OAHnh+eWsN3skA4RV1Hom2KXMmHazRgNMfM6hkjVQPn75:5h+ZkldoPK8YazqNMk6h2VQP9

    Score
    10/10
    formbookrn94ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks