Overview

overview

10

Static

static

5b5276e611...d4.exe

windows7_x64

10

5b5276e611...d4.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5b5276e6117204297cf817fee27e16d4
  • Size 651KB
  • Sample210903-xvc81agfgl
  • SHA256 4c5fd4ed6d7eda044f08d5369dd3ac130ae1e7d2f8415a77ebbc8010e2fe7c11
  • MD5 SHA1 SHA512
Score
10/10
formbookgz92ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • gz92

C2

  • http://www.peggeorge.com/gz92/

Decoy

  • ayurvedichealthformulas.com

  • plazaconstrutora.com

  • nat-hetong.info

  • eapdigital.com

  • ibluebaytvwdshop.com

  • committable.com

  • escapesbyek.com

  • mywebdesigner.pro

  • jianianhong.com

  • benvenutoqui.com

  • beiyet.com

  • theartofgifs.com

  • mbwvyksnk.icu

  • nshahwelfare.com

  • hhhservice.com

  • thechaibali.com

  • travelscreen.expert

  • best123-movies.com

  • leiahin.com

  • runplay11.com

Targets

    • Target
      5b5276e6117204297cf817fee27e16d4
    • Size 651KB
    • SHA256 4c5fd4ed6d7eda044f08d5369dd3ac130ae1e7d2f8415a77ebbc8010e2fe7c11
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookgz92ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks