Overview

overview

10

Static

static

132e157793...5d.exe

windows7_x64

10

132e157793...5d.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    132e157793925e5d203c1641e313d95d
  • Size 542KB
  • Sample210928-vbvylaceaj
  • SHA256 e14df53adff2889344d4502133a00a389e06039715c26a7724ed3f046fc683a1
  • MD5 SHA1 SHA512
Score
10/10
formbookvngbratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • vngb

C2

  • http://www.gvlc0.club/vngb/

Decoy

  • omertalasvegas.com

  • payyep.com

  • modasportss.com

  • gestionestrategicadl.com

  • teamolemiss.club

  • geektranslate.com

  • versatileventure.com

  • athletic-hub.com

  • vitanovaretreats.com

  • padison8t.com

  • tutoeasy.com

  • ediblewholesale.com

  • kangrungao.com

  • satode.com

  • prohibitionfeeds.com

  • getmorevacations.com

  • blinkworldbeauty.com

  • kdlabsallr.com

  • almanasef.com

  • transportationservicellc.com

Targets

    • Target
      132e157793925e5d203c1641e313d95d
    • Size 542KB
    • SHA256 e14df53adff2889344d4502133a00a389e06039715c26a7724ed3f046fc683a1
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookvngbratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks