Overview

overview

10

Static

static

9eebb00c70...df.exe

windows7_x64

1

9eebb00c70...df.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9eebb00c7038e89f5b8d2caca13d2ddf.exe
  • Size 533KB
  • Sample210922-pbghbafagn
  • SHA256 f03c40561ba64d0797bcf79bfefd015c8d9ca010f1bd67b3d27ffab584a9911e
  • MD5 SHA1 SHA512
Score
10/10
formbookfzsgratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • fzsg

C2

  • http://www.grouplmc.com/fzsg/

Decoy

  • thewetpatch.wtf

  • oceanfrontrecords.com

  • ultimatemecha.com

  • domainnameshq.com

  • schieksrvservice.com

  • bedandbreakfastitalia.cloud

  • rfmlc.com

  • hightechvids.com

  • greenvilledermotolgy.com

  • psilocybinforu.com

  • xjkerwen.com

  • euro-d-rev.com

  • shans-online.com

  • masterofcrypto.com

  • gamodaitaliana.online

  • lavivabet217.com

  • femsol.online

  • qafyzey.site

  • kang17.xyz

  • kilimlove.com

Targets

    • Target
      9eebb00c7038e89f5b8d2caca13d2ddf.exe
    • Size 533KB
    • SHA256 f03c40561ba64d0797bcf79bfefd015c8d9ca010f1bd67b3d27ffab584a9911e
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookfzsgratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks