Overview

overview

10

Static

static

10

b.exe

windows7_x64

10

b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b.exe

  • Size

    188KB

  • Sample

    211008-ppzk2seca4

  • MD5

    0e15293b02e591679ca4cc11fbd1252d

  • SHA1

    eeae92cd953c7fa36d5c0f31a650125a2785d4a9

  • SHA256

    d6599bdedcdb8dc16da5ba6d260fd8cbb9819e4f74556a38b2d851fc23069fd0

  • SHA512

    93d41a94294bdf4dff97852778bf5831ed0d074772eb2c45102b14f8b897e0a9ed43e8dd0da0ee0b65d4926d9f28bb20f5f31b8c333717cb41e1a2fb402718dc

Score
10/10
formbookdn7rratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Targets

    • Target

      b.exe

    • Size

      188KB

    • MD5

      0e15293b02e591679ca4cc11fbd1252d

    • SHA1

      eeae92cd953c7fa36d5c0f31a650125a2785d4a9

    • SHA256

      d6599bdedcdb8dc16da5ba6d260fd8cbb9819e4f74556a38b2d851fc23069fd0

    • SHA512

      93d41a94294bdf4dff97852778bf5831ed0d074772eb2c45102b14f8b897e0a9ed43e8dd0da0ee0b65d4926d9f28bb20f5f31b8c333717cb41e1a2fb402718dc

    Score
    10/10
    formbookdn7rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks