Overview

overview

10

Static

static

1

ef7a4266f7...82.exe

windows7_x64

10

ef7a4266f7...82.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ef7a4266f7bddf855d86e5431268e182.exe
  • Size 396KB
  • Sample201203-3a148calrn
  • SHA256 90ce350a15e0ca0d408b4b8744e51e7c87b6962eee67f1aca9bfb167ddb5106e
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.fuentenebro.wine/ugk/

Decoy

  • okaytoreopen.com

  • landscaperestorationtn.com

  • activ8.pro

  • funhomedecor.info

  • 856379727.xyz

  • universoavenue.com

  • hnxinghong.com

  • ministryfornutrition.com

  • brettjcole.com

  • allcleanwindowcleaners.com

  • areftec.com

  • danjsiemon.com

  • pradopneuserodas.com

  • thuduccity.net

  • janiruk.com

  • 010-beijing.com

  • for-the-love-of-film.com

  • zje6wc48g.xyz

  • friarventures.com

  • aminabwaxing.com

Targets

    • Target
      ef7a4266f7bddf855d86e5431268e182.exe
    • Size 396KB
    • SHA256 90ce350a15e0ca0d408b4b8744e51e7c87b6962eee67f1aca9bfb167ddb5106e
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks