Overview

overview

10

Static

static

0e715db219...47.exe

windows7_x64

10

0e715db219...47.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e715db2198ff670f4bf0e88e0e9b547

  • Size

    633KB

  • Sample

    210722-ep4xj9j1ya

  • MD5

    0e715db2198ff670f4bf0e88e0e9b547

  • SHA1

    2de5030a9261655e5879e4faba7b5e79d1dd483e

  • SHA256

    4dc8cb12314311a3bf1b1afa5cc5483284fda573f18c15ab0fef18b7b9ef9f98

  • SHA512

    8fb7ea121d51c489bac9d8d6b35e94fc8bc5e5e218da53ad952326f6c558fa7484e54842b2c6abba36c5ec5bb0e6eb51fdab46b3f98daee3569ef8c6ec400bcd

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.containerflippers.com/np0c/

Decoy

spartansurebets.com

threelakestradingco.com

metaspace.global

zjenbao.com

directlyincluded.press

peterchadri.com

learnhousebreaking.com

wonobattle.online

leadate.com

shebafarmscali.com

top4thejob.online

awakeyourfaith.com

bedford-st.com

lolwhats.com

cucurumbel.com

lokalbazaar.com

matter.pro

eastcountyanimalrescue.com

musesgirl.com

noordinarydairy.com

Targets

    • Target

      0e715db2198ff670f4bf0e88e0e9b547

    • Size

      633KB

    • MD5

      0e715db2198ff670f4bf0e88e0e9b547

    • SHA1

      2de5030a9261655e5879e4faba7b5e79d1dd483e

    • SHA256

      4dc8cb12314311a3bf1b1afa5cc5483284fda573f18c15ab0fef18b7b9ef9f98

    • SHA512

      8fb7ea121d51c489bac9d8d6b35e94fc8bc5e5e218da53ad952326f6c558fa7484e54842b2c6abba36c5ec5bb0e6eb51fdab46b3f98daee3569ef8c6ec400bcd

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks