Overview

overview

10

Static

static

9b9e4894df...e9.exe

windows7_x64

10

9b9e4894df...e9.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9b9e4894df7befddf3fb761a2331fbe9.exe
  • Size 605KB
  • Sample210213-63dc5kj5m2
  • SHA256 0fbe3e570e7074462b9c44528e6a1a3e9a4d02775acf4e9877f4f3ac87cdbd2e
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.paeonystore.com/kre/

Decoy

  • alpacaksa.com

  • ravneetkhurana.com

  • neverstopip.com

  • sunarrallc.com

  • lojag3wire.com

  • kiffbrother.com

  • pawantakespawn.com

  • sadarbarta.com

  • blogdoruan.life

  • jadeitesecurity.com

  • edcincorp.com

  • xjp168.com

  • babylist.info

  • ennobleempiremarketing.com

  • amazon-co-jp.store

  • regenlighting.com

  • zhengqiantv.com

  • carbeloy.com

  • lemenzz.com

  • enigmacombine.icu

Targets

    • Target
      9b9e4894df7befddf3fb761a2331fbe9.exe
    • Size 605KB
    • SHA256 0fbe3e570e7074462b9c44528e6a1a3e9a4d02775acf4e9877f4f3ac87cdbd2e
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks