Overview

overview

10

Static

static

b60fb0b317...91.exe

windows7_x64

10

b60fb0b317...91.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b60fb0b3174ffd6ccf46d23e5dd4f291.exe

  • Size

    1.6MB

  • Sample

    210727-3b4hj5l99e

  • MD5

    b60fb0b3174ffd6ccf46d23e5dd4f291

  • SHA1

    fedb0bc2f7e46d58061b8742b5d5ad61b525ab4f

  • SHA256

    56d324b70dec3c259864216d918929470e10dc5582ae70f238aaad4887358d7b

  • SHA512

    e5f7997d6b8df79d5897b438261eef644264d04d09604c5a0de485bee42df5c9374450949fb30097f7ab4e50de152d950b65f7ca5e1eea1e5088d8288a079aa6

Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.meilleurspromo.com/lmsa/

Decoy

functionalkitchen.net

jiangxichuangke.com

lonerkont.space

champcarfanatics.com

csillag-szuletik.info

jupitowatch.com

lmcomputer.net

alfawize.com

mouthconsults.com

gruppolarta.com

gaymyway.com

bostonpeach.com

bioclean.pro

thingsandotherstuff.com

gencmetals.com

cwivf.com

nbhgddfgggnhhmhln.com

myscoutinglife.com

ccubk.com

cheapfloatingrentals.com

Targets

    • Target

      b60fb0b3174ffd6ccf46d23e5dd4f291.exe

    • Size

      1.6MB

    • MD5

      b60fb0b3174ffd6ccf46d23e5dd4f291

    • SHA1

      fedb0bc2f7e46d58061b8742b5d5ad61b525ab4f

    • SHA256

      56d324b70dec3c259864216d918929470e10dc5582ae70f238aaad4887358d7b

    • SHA512

      e5f7997d6b8df79d5897b438261eef644264d04d09604c5a0de485bee42df5c9374450949fb30097f7ab4e50de152d950b65f7ca5e1eea1e5088d8288a079aa6

    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks