Overview

overview

10

Static

static

Arrival Notice.scr

windows7_x64

10

Arrival Notice.scr

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Arrival Notice.scr
  • Size 1.0MB
  • Sample210119-ddfs8fhkn6
  • SHA256 14ee2894b546ba6d7835ee4dd8e07ef72fb10bfaebec8f1687da4559267cb72e
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.thesiromiel.com/kgw/

Decoy

  • valentinakasu.com

  • soyelmatador.com

  • collaborativeprosperity.com

  • power8brokers.com

  • nexus-ink.com

  • manpasandmeatmarket.com

  • the-ethical-forums.today

  • maryannpark.com

  • bikininbodymommy.com

  • pxwuo.com

  • bigbangmerch.com

  • okaysinger.com

  • shopcarpe.com

  • rainbowhillsswimclub.com

  • crifinmarket.com

  • ebl-play.net

  • forceandsonsequipment.com

  • viagraytqwi.com

  • latashashop.com

  • suffocatinglymundanepodcast.com

Targets

    • Target
      Arrival Notice.scr
    • Size 1.0MB
    • SHA256 14ee2894b546ba6d7835ee4dd8e07ef72fb10bfaebec8f1687da4559267cb72e
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks