Overview

overview

10

Static

static

027eb7b43d...c9.exe

windows7_x64

10

027eb7b43d...c9.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    027eb7b43d4c9d6c2340d2c2391cd6c9
  • Size 705KB
  • Sample210902-rn2p5adcdl
  • SHA256 2e607b4e0cec9f7569023816f39f2822e4363c9b67ca3bf8eb128932e42a0535
  • MD5 SHA1 SHA512
Score
10/10
formbookcrg3ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • crg3

C2

  • http://www.infinityormus.com/crg3/

Decoy

  • g-strip.com

  • mercedestaydo.com

  • bettypersonalized.com

  • smithsndvine.com

  • lrkingdee.com

  • steigtechnik.club

  • joyous.world

  • lockhartsecurity.net

  • dogpouchy.com

  • sallysharman.com

  • moylook.online

  • safercheckin.com

  • pinsiteup14.online

  • infinitytattoocare.com

  • daiwans1.com

  • nativress.com

  • vanessagracebang.xyz

  • adiguzelboya.net

  • getiphoneforfree.com

  • villadelsolguadalupe.com

Targets

    • Target
      027eb7b43d4c9d6c2340d2c2391cd6c9
    • Size 705KB
    • SHA256 2e607b4e0cec9f7569023816f39f2822e4363c9b67ca3bf8eb128932e42a0535
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookcrg3ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks