Overview

overview

10

Static

static

2bf4191dc9...d5.exe

windows7_x64

10

2bf4191dc9...d5.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2bf4191dc9c78a5e47045e779a653ad5.exe
  • Size 1.9MB
  • Sample210219-q1axtnyn6j
  • SHA256 1107284bdeebfe9255dcc17fcf19787a299307bf34e733f149430d334ddeda6a
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.paeonystore.com/kre/

Decoy

  • alpacaksa.com

  • ravneetkhurana.com

  • neverstopip.com

  • sunarrallc.com

  • lojag3wire.com

  • kiffbrother.com

  • pawantakespawn.com

  • sadarbarta.com

  • blogdoruan.life

  • jadeitesecurity.com

  • edcincorp.com

  • xjp168.com

  • babylist.info

  • ennobleempiremarketing.com

  • amazon-co-jp.store

  • regenlighting.com

  • zhengqiantv.com

  • carbeloy.com

  • lemenzz.com

  • enigmacombine.icu

Targets

    • Target
      2bf4191dc9c78a5e47045e779a653ad5.exe
    • Size 1.9MB
    • SHA256 1107284bdeebfe9255dcc17fcf19787a299307bf34e733f149430d334ddeda6a
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks