Overview

overview

10

Static

static

PO2364#FD21200.exe

windows7_x64

10

PO2364#FD21200.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO2364#FD21200.exe

  • Size

    962KB

  • Sample

    210118-74w1v6yr1n

  • MD5

    e8421cdad373cbd60667510c8cb5709d

  • SHA1

    ea4906ef27cd9672eafc7acffb6376c9842e9d3c

  • SHA256

    89997eff59d390acca1d0b385aa4714417178afb9011ac5d07e290fac2ca51b9

  • SHA512

    a055ef641e73750a847ead59de41d3215ffa6f53a124744d09fd062b2efe260479e0f440915b52574fc37d2c16014db8bef08c35d03339713ffaefe6abf2101c

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.styrelseforum.com/p95n/

Decoy

kimberlyrutledge.com

auctus.agency

johnemotions.com

guilt-brilliant.com

wxshangdian.com

theolivetreeonline.com

stellarfranchisebrands.com

every1no1.com

hoangthanhgroup.com

psm-gen.com

kingdomwow.com

digitalksr.com

karynpolitoforlg.com

youthdaycalgary.com

libertyhandymanservicesllc.com

breatheohio.com

allenleather.com

transformafter50.info

hnhsylsb.com

hmtradebd.com

Targets

    • Target

      PO2364#FD21200.exe

    • Size

      962KB

    • MD5

      e8421cdad373cbd60667510c8cb5709d

    • SHA1

      ea4906ef27cd9672eafc7acffb6376c9842e9d3c

    • SHA256

      89997eff59d390acca1d0b385aa4714417178afb9011ac5d07e290fac2ca51b9

    • SHA512

      a055ef641e73750a847ead59de41d3215ffa6f53a124744d09fd062b2efe260479e0f440915b52574fc37d2c16014db8bef08c35d03339713ffaefe6abf2101c

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks