Overview

overview

10

Static

static

LIST OF PR...ED.exe

windows7_x64

10

LIST OF PR...ED.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    LIST OF PRODUCTS NEEDED.exe
  • Size 559KB
  • Sample201119-88la8ezjyn
  • SHA256 ded4435057919aa79f8453db4172ffd89198323fa247e70daa418a7a21136df2
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.dagadia.com/pna/

Decoy

  • responsibleson.com

  • crown-friendly.info

  • cyberwastemanagement.com

  • broncoscards.com

  • artwithjessica.com

  • present-motherhood.com

  • alarmaantiokupacion.com

  • bluecollarjim.com

  • sneguard.com

  • digitalsept.com

  • terrycareerconsulting.com

  • watch-lover.site

  • funkytees.kiwi

  • xn--f1adbavc.online

  • hitchlove.com

  • elmejorsetup.com

  • koc14338.com

  • obruchalnye-kolca.com

  • zambezia-promo.info

  • mataangin.net

Targets

    • Target
      LIST OF PRODUCTS NEEDED.exe
    • Size 559KB
    • SHA256 ded4435057919aa79f8453db4172ffd89198323fa247e70daa418a7a21136df2
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks