Overview

overview

10

Static

static

SKY POUNDS.exe

windows7_x64

10

SKY POUNDS.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SKY POUNDS.exe

  • Size

    30KB

  • Sample

    201204-2lrf6n3w6e

  • MD5

    a803f4d55bdc06aee301ff972ea06b05

  • SHA1

    8cc8b7f9772637fb0d6df77423ae833e66587cc0

  • SHA256

    2919a5d96ade5e0f2967d98a7b49b1f612435ed6a6b3843424a8c1e99ea0e9ab

  • SHA512

    f7152faf2f9aeaed417b0f38dc7bb9b8dad50002c56e455b64654bfeb984ebe94c19541fd673e08b6954960958ac7b476eb5a9ed38524278ef87653d8df855e7

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.runwithit.media/bu43/

Decoy

bearrootstherapy.com

odmpay.com

johnfornmgov.com

astrodhaam.com

pumavps.com

empireconstructiontx.com

theboujeestop.com

indictthem.com

plantationbarnof1810.com

nsxs.xyz

lgshowroom.com

allinlifestyle.club

ik-com.net

saitamacity-sports.com

neuromuscularmassagetherapy.com

freespiritnutrition.com

alexanderhamilton.computer

happysay.co.uk

nndesignpr.com

lightweightmouldings.com

Targets

    • Target

      SKY POUNDS.exe

    • Size

      30KB

    • MD5

      a803f4d55bdc06aee301ff972ea06b05

    • SHA1

      8cc8b7f9772637fb0d6df77423ae833e66587cc0

    • SHA256

      2919a5d96ade5e0f2967d98a7b49b1f612435ed6a6b3843424a8c1e99ea0e9ab

    • SHA512

      f7152faf2f9aeaed417b0f38dc7bb9b8dad50002c56e455b64654bfeb984ebe94c19541fd673e08b6954960958ac7b476eb5a9ed38524278ef87653d8df855e7

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks