Overview

overview

10

Static

static

a3ab9dcf6e...a0.exe

windows7_x64

10

a3ab9dcf6e...a0.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a3ab9dcf6e3ba0e1f026fcf4b18065a0.exe
  • Size 959KB
  • Sample210817-wspqb4as5e
  • SHA256 ecacac4e9f514e780ff7124b6fdd97251dcec9947d5815166b2b57d2a41ddf0e
  • MD5 SHA1 SHA512
Score
10/10
formbookgz92ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • gz92

C2

  • http://www.peggeorge.com/gz92/

Decoy

  • ayurvedichealthformulas.com

  • plazaconstrutora.com

  • nat-hetong.info

  • eapdigital.com

  • ibluebaytvwdshop.com

  • committable.com

  • escapesbyek.com

  • mywebdesigner.pro

  • jianianhong.com

  • benvenutoqui.com

  • beiyet.com

  • theartofgifs.com

  • mbwvyksnk.icu

  • nshahwelfare.com

  • hhhservice.com

  • thechaibali.com

  • travelscreen.expert

  • best123-movies.com

  • leiahin.com

  • runplay11.com

Targets

    • Target
      a3ab9dcf6e3ba0e1f026fcf4b18065a0.exe
    • Size 959KB
    • SHA256 ecacac4e9f514e780ff7124b6fdd97251dcec9947d5815166b2b57d2a41ddf0e
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookgz92ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks