Overview

overview

10

Static

static

INVOICE-OV...pg.scr

windows7_x64

10

INVOICE-OV...pg.scr

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    INVOICE-OVERDUE.jpg.scr
  • Size 1005KB
  • Sample210316-avxvmz5cwn
  • SHA256 f782d415e7975acdf521b8a92ceb1e1f5c51c030dfdfdf5d798ad381003ed1bf
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.the-techs.info/chue/

Decoy

  • wowmovies.today

  • magentos6.com

  • bi-nav.com

  • atlantahawks.sucks

  • wluabjy.icu

  • kevableinsights.com

  • lavidaenaustralia.com

  • stonermadeapparel.net

  • sondein.com

  • cirquedusoleilartist.com

  • kanjitem.com

  • tomofalltrades.site

  • mecanico.guru

  • tech2020s.com

  • amesoneco.com

  • theawfulliar.com

  • californiaadugurus.com

  • rentalservicesolutions.com

  • fsxbhd.club

  • casino-seo.com

Targets

    • Target
      INVOICE-OVERDUE.jpg.scr
    • Size 1005KB
    • SHA256 f782d415e7975acdf521b8a92ceb1e1f5c51c030dfdfdf5d798ad381003ed1bf
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks