Overview

overview

10

Static

static

HOPEFUL.exe

windows7_x64

10

HOPEFUL.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HOPEFUL.exe

  • Size

    3.3MB

  • Sample

    210113-6f3qb3zqwa

  • MD5

    9c15af175868121cc014666189d52dae

  • SHA1

    3ba03f47a8762368538e47806353f55da43d46ac

  • SHA256

    7c8f873fc34661a785875f76a1f3b1aff6719e69d2a4ea5d2d94f849282b623a

  • SHA512

    48fb5c66bda58fa8b76e276e61afc36576cddb9e27a601767e10f2d554c669613249aca6908191cb30a850b8ef207a69bb1a73c1fe25c93e7ef40379a3950a02

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.registeredagentfirm.com/jqc/

Decoy

strahlenschutz.digital

soterppe.com

wlw-hnlt.com

topheadlinetowitness-today.info

droriginals.com

baculatechie.online

definity.finance

weddingmustgoon.com

ludisenofloral.com

kenniscourtureconsignments.com

dl888.net

singledynamics.com

internetmarkaching.com

solidconstruct.site

ip-freight.com

11sxsx.com

incomecontent.com

the343radio.com

kimberlygoedhart.net

dgdoughnuts.net

Targets

    • Target

      HOPEFUL.exe

    • Size

      3.3MB

    • MD5

      9c15af175868121cc014666189d52dae

    • SHA1

      3ba03f47a8762368538e47806353f55da43d46ac

    • SHA256

      7c8f873fc34661a785875f76a1f3b1aff6719e69d2a4ea5d2d94f849282b623a

    • SHA512

      48fb5c66bda58fa8b76e276e61afc36576cddb9e27a601767e10f2d554c669613249aca6908191cb30a850b8ef207a69bb1a73c1fe25c93e7ef40379a3950a02

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks