Overview

overview

10

Static

static

SWIFT 0083...df.exe

windows7_x64

10

SWIFT 0083...df.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SWIFT 00838303383 pdf.exe
  • Size 815KB
  • Sample210705-dtygmlycax
  • SHA256 0726096c82c2c643c7de2ed48533e0a545e71f2294433cd7df473aebe9f17681
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

C2

  • http://www.kmresults.com/n7ak/

Decoy

  • modischoolcbse.com

  • theneverwinter.com

  • rszkjx-vps-hosting.website

  • fnihil.com

  • 1pbet.com

  • nnowzscorrez.com

  • uaotgvjl.icu

  • starmapsqatar.com

  • ekisilani.com

  • extradeepsheets.com

  • jam-nins.com

  • buranly.com

  • orixentertainment.com

  • rawtech.energy

  • myol.guru

  • utex.club

  • jiapie.com

  • wowig.store

  • wweidlyyl.com

  • systaskautomation.com

Targets

    • Target
      SWIFT 00838303383 pdf.exe
    • Size 815KB
    • SHA256 0726096c82c2c643c7de2ed48533e0a545e71f2294433cd7df473aebe9f17681
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks