Overview

overview

10

Static

static

PO#218740.exe

windows7_x64

10

PO#218740.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO#218740.exe

  • Size

    210KB

  • Sample

    210113-4qc36yngda

  • MD5

    f12ead1a33327f7919a71b0aa86fb073

  • SHA1

    d4aea16dff8ff036a5135e40ed40c5d2ecee7806

  • SHA256

    ceb2632fac30996ac58a50455d968873321f7a18972db02e9535b485a3b0e2f7

  • SHA512

    61fbe590c3f394ad3d89922c5e510e468e54e7bd0433d804f309d34eb3d1a94b0eaa92a7c634e9cc2de6b640fd70b5e4ff758939bf1c9af2c651ca069d8b46e5

Score
10/10
formbookxloaderloaderratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.tzmm.net/wpsb/

Decoy

0817ls.com

drawbeirut.com

respiteready.com

yufkayurek.com

poss-plus.com

distributesimilar.com

mcmendzlawns.com

bingent.info

wellnessandcomfort.com

humilityhope.com

recetasfes.com

olala.asia

epochryphal.com

room-lettings-onlines.club

lvc.xyz

reicolee.com

davidmarkphotovideo.photography

corpuschristicarbuyers.com

tutorialyoutube.com

ativ.pro

Targets

    • Target

      PO#218740.exe

    • Size

      210KB

    • MD5

      f12ead1a33327f7919a71b0aa86fb073

    • SHA1

      d4aea16dff8ff036a5135e40ed40c5d2ecee7806

    • SHA256

      ceb2632fac30996ac58a50455d968873321f7a18972db02e9535b485a3b0e2f7

    • SHA512

      61fbe590c3f394ad3d89922c5e510e468e54e7bd0433d804f309d34eb3d1a94b0eaa92a7c634e9cc2de6b640fd70b5e4ff758939bf1c9af2c651ca069d8b46e5

    Score
    10/10
    formbookxloaderloaderratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks