Overview

overview

10

Static

static

yeni sipariş.exe

windows7_x64

10

yeni sipariş.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    yeni sipariş.exe
  • Size 544KB
  • Sample201015-51dcdac2aj
  • SHA256 306dc076ebd63fe8d969a99984470c480737e86eba1fb55ebe1ef49a8b987565
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.kumcal.com/fs8/

Decoy

  • deanpalm.net

  • dinu-living.com

  • setsomegoals.com

  • craftyfresh.email

  • cleantons.com

  • szysjfjx.com

  • shestakova.info

  • 70skinstore.com

  • ampletrade.ltd

  • cmmcwomen.group

  • michinoeki-taka.com

  • auntoni.com

  • huochegw.com

  • abovekulture.com

  • gzjige.com

  • americastandproudagain.com

  • hobbyhousekennels.com

  • 1020waterviewdrive.com

  • 5927399.com

  • gabipareras.net

Targets

    • Target
      yeni sipariş.exe
    • Size 544KB
    • SHA256 306dc076ebd63fe8d969a99984470c480737e86eba1fb55ebe1ef49a8b987565
    • MD5 SHA1 SHA512
    Score
    10/10
    rattrojanspywarestealerformbook

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks