Overview

overview

10

Static

static

bd53fc041a...71.exe

windows7_x64

10

bd53fc041a...71.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    bd53fc041a6e364f163c70e2bcf38a1565f3764a31b8c94de466fce780f9ab71
  • Size 1.5MB
  • Sample201115-hpcys3svt6
  • SHA256 bd53fc041a6e364f163c70e2bcf38a1565f3764a31b8c94de466fce780f9ab71
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.progressaofinanceira.com/di4r/

Decoy

  • 2299diamond301.com

  • jbjuicer.com

  • dimj3yc27j0.com

  • citestaccnt1598424958.com

  • pinchnzest.com

  • hextrainer.com

  • ngamezment.com

  • internationalprinting.press

  • caowenkj.com

  • designslg.com

  • kk-e.net

  • tinz324.online

  • yenilememerkezi.net

  • nedukelspenn.com

  • batterydoorbell.com

  • mylewop.com

  • reinovar.com

  • mantapmedia.com

  • utkalodia.com

  • bookesmielawrence.com

Targets

    • Target
      bd53fc041a6e364f163c70e2bcf38a1565f3764a31b8c94de466fce780f9ab71
    • Size 1.5MB
    • SHA256 bd53fc041a6e364f163c70e2bcf38a1565f3764a31b8c94de466fce780f9ab71
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks