Overview

overview

10

Static

static

Quote#56432.exe

windows7_x64

10

Quote#56432.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Quote#56432.exe
  • Size 537KB
  • Sample210915-nv55caafa6
  • SHA256 97ea895e92f76192010e02f12aca8ec4ffa1b667e84c9958332d280ced624402
  • MD5 SHA1 SHA512
Score
10/10
formbookvd9nratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • vd9n

C2

  • http://www.constructioncleanup.pro/vd9n/

Decoy

  • theunwrappedcollective.com

  • seckj-ic.com

  • tyresandover.com

  • thetrophyworld.com

  • fonggrconstruction.com

  • hopiproject.com

  • sktitle.com

  • charlotteobscurer.com

  • qjuhe.com

  • girlzglitter.com

  • createmylawn.com

  • hempcbgpill.com

  • zzdfdzkj.com

  • shreehariessential.com

  • 226sm.com

  • getcupscall.com

  • neuralviolin.com

  • sanskaar.life

  • xn--fhqrm54yyukopc.com

  • togetherx4fantasy5star.today

Targets

    • Target
      Quote#56432.exe
    • Size 537KB
    • SHA256 97ea895e92f76192010e02f12aca8ec4ffa1b667e84c9958332d280ced624402
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookvd9nratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks