Overview

overview

10

Static

static

nova narudžba.exe

windows7_x64

10

nova narudžba.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    nova narudžba.exe
  • Size 925KB
  • Sample201027-3a77e5ma5a
  • SHA256 262425bbcb5e75f86acb044c68560ca672503b3fb26768b733d49662ec3811cb
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.kumcal.com/fs8/

Decoy

  • deanpalm.net

  • dinu-living.com

  • setsomegoals.com

  • craftyfresh.email

  • cleantons.com

  • szysjfjx.com

  • shestakova.info

  • 70skinstore.com

  • ampletrade.ltd

  • cmmcwomen.group

  • michinoeki-taka.com

  • auntoni.com

  • huochegw.com

  • abovekulture.com

  • gzjige.com

  • americastandproudagain.com

  • hobbyhousekennels.com

  • 1020waterviewdrive.com

  • 5927399.com

  • gabipareras.net

Targets

    • Target
      nova narudžba.exe
    • Size 925KB
    • SHA256 262425bbcb5e75f86acb044c68560ca672503b3fb26768b733d49662ec3811cb
    • MD5 SHA1 SHA512
    Score
    10/10
    rattrojanspywarestealerformbook

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks