Overview

overview

10

Static

static

DutkUUqm2mZl3Fl.exe

windows7_x64

DutkUUqm2mZl3Fl.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    DutkUUqm2mZl3Fl.exe
  • Size 698KB
  • Sample210902-3yhm5pmv6j
  • SHA256 f9dc7de32eb824444dce368b02ff4f6648fc7d01059a04b8a3d2ce8092f1c0ce
  • MD5 SHA1 SHA512
Score
10/10
formbookgz92ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • gz92

C2

  • http://www.peggeorge.com/gz92/

Decoy

  • ayurvedichealthformulas.com

  • plazaconstrutora.com

  • nat-hetong.info

  • eapdigital.com

  • ibluebaytvwdshop.com

  • committable.com

  • escapesbyek.com

  • mywebdesigner.pro

  • jianianhong.com

  • benvenutoqui.com

  • beiyet.com

  • theartofgifs.com

  • mbwvyksnk.icu

  • nshahwelfare.com

  • hhhservice.com

  • thechaibali.com

  • travelscreen.expert

  • best123-movies.com

  • leiahin.com

  • runplay11.com

Targets

    • Target
      DutkUUqm2mZl3Fl.exe
    • Size 698KB
    • SHA256 f9dc7de32eb824444dce368b02ff4f6648fc7d01059a04b8a3d2ce8092f1c0ce
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookgz92ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks