Overview

overview

10

Static

static

a576607b8a...e1.exe

windows7_x64

10

a576607b8a...e1.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a576607b8a3089dea60d25f123fedfe1.exe
  • Size 844KB
  • Sample210823-7ebmfhwln2
  • SHA256 501242ffaabd951fbd62a6b12cfe8955915f65acc7d6c99effd41366054ccdca
  • MD5 SHA1 SHA512
Score
10/10
formbookgz92ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • gz92

C2

  • http://www.peggeorge.com/gz92/

Decoy

  • ayurvedichealthformulas.com

  • plazaconstrutora.com

  • nat-hetong.info

  • eapdigital.com

  • ibluebaytvwdshop.com

  • committable.com

  • escapesbyek.com

  • mywebdesigner.pro

  • jianianhong.com

  • benvenutoqui.com

  • beiyet.com

  • theartofgifs.com

  • mbwvyksnk.icu

  • nshahwelfare.com

  • hhhservice.com

  • thechaibali.com

  • travelscreen.expert

  • best123-movies.com

  • leiahin.com

  • runplay11.com

Targets

    • Target
      a576607b8a3089dea60d25f123fedfe1.exe
    • Size 844KB
    • SHA256 501242ffaabd951fbd62a6b12cfe8955915f65acc7d6c99effd41366054ccdca
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookgz92ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks