Overview

overview

10

Static

static

3dad997528...66.exe

windows7_x64

10

3dad997528...66.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3dad99752800d2418553870b6e932c66.exe
  • Size 793KB
  • Sample210304-44ry56wpfe
  • SHA256 92f656d44d38fbc5e7964e36634bf95d18e157228624d1b38ea933633579ddc4
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.disciplinemonkey.com/njo/

Decoy

  • thehungryaperture.com

  • vincemceveety.com

  • thebuildingmgr.com

  • babaobox.com

  • qykrot.site

  • wald-pack.com

  • yeasuc.com

  • toplevelsealcoating.net

  • seebeec.com

  • williamsburgcelebrates.com

  • bons-sites-web.com

  • rnlasermedspasolutions.com

  • tercerintento.com

  • oliloudalmatians.com

  • pj-kingdom.com

  • karen-elmir.com

  • wellhealthfamilymed.com

  • learningjourneytx.com

  • calmyourmidnight.com

  • nextuptechs.com

Targets

    • Target
      3dad99752800d2418553870b6e932c66.exe
    • Size 793KB
    • SHA256 92f656d44d38fbc5e7964e36634bf95d18e157228624d1b38ea933633579ddc4
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks