Overview

overview

10

Static

static

order 00912.exe

windows7_x64

10

order 00912.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    order 00912.exe

  • Size

    636KB

  • Sample

    211001-tvsrxaccg9

  • MD5

    ed5dab5669de8da4edeed8e8ff3b017b

  • SHA1

    63698f27cd2090215ed905c9e9a6710337746a48

  • SHA256

    9e13a5c939cf22a9d4b60631d6c397903095561e51a9aaaca44be3666abf75e5

  • SHA512

    71156d5d8c472252d429fc1f15f03e6a457d03ae274b9d21b7ca7fa54be9677ba3cfbe8a6dbbc0b67b57f63a5114607c948d54cacf05ee600f7c2f0aa52830d3

Score
10/10
formbookdn7rratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Targets

    • Target

      order 00912.exe

    • Size

      636KB

    • MD5

      ed5dab5669de8da4edeed8e8ff3b017b

    • SHA1

      63698f27cd2090215ed905c9e9a6710337746a48

    • SHA256

      9e13a5c939cf22a9d4b60631d6c397903095561e51a9aaaca44be3666abf75e5

    • SHA512

      71156d5d8c472252d429fc1f15f03e6a457d03ae274b9d21b7ca7fa54be9677ba3cfbe8a6dbbc0b67b57f63a5114607c948d54cacf05ee600f7c2f0aa52830d3

    Score
    10/10
    formbookdn7rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks