Overview

overview

10

Static

static

86d0a0cbb7...be.exe

windows7_x64

10

86d0a0cbb7...be.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    86d0a0cbb77b6157d2da7ab7b5d1c2be
  • Size 400KB
  • Sample211006-kvgj7saha4
  • SHA256 fedeb19031bcc0941b0943dd3ed45ee6095b8c489c072c85e513b414abf8acf5
  • MD5 SHA1 SHA512
Score
10/10
formbookvngbratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • vngb

C2

  • http://www.gvlc0.club/vngb/

Decoy

  • omertalasvegas.com

  • payyep.com

  • modasportss.com

  • gestionestrategicadl.com

  • teamolemiss.club

  • geektranslate.com

  • versatileventure.com

  • athletic-hub.com

  • vitanovaretreats.com

  • padison8t.com

  • tutoeasy.com

  • ediblewholesale.com

  • kangrungao.com

  • satode.com

  • prohibitionfeeds.com

  • getmorevacations.com

  • blinkworldbeauty.com

  • kdlabsallr.com

  • almanasef.com

  • transportationservicellc.com

Targets

    • Target
      86d0a0cbb77b6157d2da7ab7b5d1c2be
    • Size 400KB
    • SHA256 fedeb19031bcc0941b0943dd3ed45ee6095b8c489c072c85e513b414abf8acf5
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookvngbratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks