Overview

overview

10

Static

static

ins.exe

windows7_x64

10

ins.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ins.exe

  • Size

    344KB

  • Sample

    210118-hb2jsqp2ze

  • MD5

    627e1b3240a17fdec14472db377f468b

  • SHA1

    8e664b47f1d1696a268ddc246ebd9470e4e6a6dd

  • SHA256

    9e15ebbf48baef0f33c9ceb2e69566ec71d77271270a65dc5a7cf19a450f1a62

  • SHA512

    d83e9f514a551e46ebc54df3debb45d8d8aae80c2598a3b819baf4872affc96d5ef5032024dd272ccae4b8a9e07234bcba917dd8720190e8e72dd2d0b4f41562

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

C2

http://www.besthandstool.icu/uds2/

Decoy

hrrecruitertraining.com

pancakeroll.club

equiposddl.com

fab-9corporation.com

seanformo.com

fisika-uinam.com

cheeseburgerpasta.com

cherylkarlfineartist.com

wunderprodukte.net

3912699.com

sanitizyo.com

856381190.xyz

aprobet42.xyz

knutsfastigheter.com

disalvospizzaitalian.com

energysavingsolarpower.com

oldwonderful.com

se32688.com

samkecollection.com

colegioreynosa.com

Targets

    • Target

      ins.exe

    • Size

      344KB

    • MD5

      627e1b3240a17fdec14472db377f468b

    • SHA1

      8e664b47f1d1696a268ddc246ebd9470e4e6a6dd

    • SHA256

      9e15ebbf48baef0f33c9ceb2e69566ec71d77271270a65dc5a7cf19a450f1a62

    • SHA512

      d83e9f514a551e46ebc54df3debb45d8d8aae80c2598a3b819baf4872affc96d5ef5032024dd272ccae4b8a9e07234bcba917dd8720190e8e72dd2d0b4f41562

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks