Overview

overview

10

Static

static

MV. XIN YU_pdf.exe

windows7_x64

10

MV. XIN YU_pdf.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MV. XIN YU_pdf.exe

  • Size

    857KB

  • Sample

    210114-ccspv2rx2a

  • MD5

    a30321feb78baf3e0d9ee124d90014a1

  • SHA1

    28f6d239e6b4ce3ce2a362e1f5ac5519e6279bf8

  • SHA256

    cf6959fe2bb4c2e078a8bb51c097dfd79bc0ca5cd296090a897ecb30a3ee6102

  • SHA512

    b8f5f400e52951c1d30d675fa544042631136014bdfe29a62b36849481a301198e937241012717e3c8b11b4444e9eb387726b44f485ff5dafa1e0fc0f0babd4c

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.huynhanhdung.com/kna/

Decoy

lawrencefiredepartment.com

executivehomeoffices.com

solfed.world

oshawaexchange.com

webdavlexstore.com

youpieb.com

chiller-master.com

bearstoragetn.com

daf90x16.com

gewhacaalouine.com

simplyezi.com

cstechnologyservices.com

nosyboats.com

thecocomarie.com

vetinaryeco.club

americangoselfilm.com

gdsuhejia.com

verbunden-sein.net

the-minerva.com

loctrantv.com

Targets

    • Target

      MV. XIN YU_pdf.exe

    • Size

      857KB

    • MD5

      a30321feb78baf3e0d9ee124d90014a1

    • SHA1

      28f6d239e6b4ce3ce2a362e1f5ac5519e6279bf8

    • SHA256

      cf6959fe2bb4c2e078a8bb51c097dfd79bc0ca5cd296090a897ecb30a3ee6102

    • SHA512

      b8f5f400e52951c1d30d675fa544042631136014bdfe29a62b36849481a301198e937241012717e3c8b11b4444e9eb387726b44f485ff5dafa1e0fc0f0babd4c

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks