Overview

overview

10

Static

static

5c5fc01dc4...85.exe

windows7_x64

10

5c5fc01dc4...85.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5c5fc01dc40597ac6527f07889f52b85.exe
  • Size 531KB
  • Sample201009-vwrce2rgxa
  • SHA256 7f9ae2230e8288dc9d2be085d10b696542ac35641853f0afc85ca08d48f3c154
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.lfmh888.com/pth/

Decoy

  • twinlensfilm.com

  • nerdtoysuk.info

  • moi2.com

  • xaqmsl.com

  • creditosmp.com

  • agroventasdeguatemala.com

  • bestmixer.pro

  • queguayperu.com

  • o-wish.com

  • pros2311.com

  • christopherwisdomrealtor.com

  • snowdengroupllc.com

  • capture-boutique.com

  • hooplaphotobooth.com

  • qiclcrjdn.icu

  • ymavispa.com

  • internetserviceonly.com

  • littlebitlessrisky.com

  • negarpack.com

  • thedepotgsr.com

Targets

    • Target
      5c5fc01dc40597ac6527f07889f52b85.exe
    • Size 531KB
    • SHA256 7f9ae2230e8288dc9d2be085d10b696542ac35641853f0afc85ca08d48f3c154
    • MD5 SHA1 SHA512
    Score
    10/10
    rattrojanspywarestealerformbook

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks