Overview

overview

10

Static

static

10

ORDER_29741.exe

windows7_x64

10

ORDER_29741.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ORDER_29741.exe

  • Size

    395KB

  • Sample

    201109-7l72efhxf6

  • MD5

    b9c6aad2753d835eefeeae486fac18ba

  • SHA1

    f2744185e692cedec652edb07b8a174c34e9f327

  • SHA256

    e3f68e3679fc2ab587e712ce137e107318ebaa6bd5e724a76200bb10c945312b

  • SHA512

    1856ee344f1fecd55dc7823f0eb6c1999bd65a244da100b1fbf0550c9a7188c099854bf664f192a71b578a8ce5342854e1934fb2b8522082bc9412b23751fb1d

Score
10/10
formbooksnakebotratsnakebotspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.nyoxibwer.com/20w/

Decoy

cofounder.technology

mrbajaf.com

xn--w9s874cfjq5fk.com

haliciogluhali.net

vanessadunfordhere.com

lookguy.win

91javac.com

goldennd.com

nwatheeliteteam.net

tumpukganda.com

clarservicios.com

koghana.com

workingwithroland.com

yellowsocialbox.com

under-dawg.com

sdtjtzyz.com

banditaerialproductions.com

newssmog.com

tefnmp.men

rebelialabel.com

Targets

    • Target

      ORDER_29741.exe

    • Size

      395KB

    • MD5

      b9c6aad2753d835eefeeae486fac18ba

    • SHA1

      f2744185e692cedec652edb07b8a174c34e9f327

    • SHA256

      e3f68e3679fc2ab587e712ce137e107318ebaa6bd5e724a76200bb10c945312b

    • SHA512

      1856ee344f1fecd55dc7823f0eb6c1999bd65a244da100b1fbf0550c9a7188c099854bf664f192a71b578a8ce5342854e1934fb2b8522082bc9412b23751fb1d

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks