Overview

overview

10

Static

static

1

PISALES-CO...FT.exe

windows7_x64

10

PISALES-CO...FT.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PISALES-CONTRACT_BANK.SWIFT.exe
  • Size 222KB
  • Sample210614-lpjftjsz8a
  • SHA256 d654d8728cd5b7c24ac8b82f7fbc6e7429b46fdb57bb384534242ca4e5a5043a
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

C2

  • http://www.mistermott.com/iic6/

Decoy

  • naplesewebdesign.com

  • primary-acc-intl.com

  • id82dtrk.com

  • influencecoders.com

  • afunnypic.com

  • ogvwgo.com

  • motorolasolutions25years.com

  • natooz.com

  • goldenleafplantation.com

  • delectation-method.com

  • thebase.agency

  • wineferment.com

  • popsmokes.info

  • savannacherry.com

  • ridemeetup.com

  • ukrasex.com

  • fiestygreek.com

  • melonkitchens.com

  • seo.repair

  • support-online.network

Targets

    • Target
      PISALES-CONTRACT_BANK.SWIFT.exe
    • Size 222KB
    • SHA256 d654d8728cd5b7c24ac8b82f7fbc6e7429b46fdb57bb384534242ca4e5a5043a
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks