Overview

overview

10

Static

static

76d6388e29...82.exe

windows7_x64

10

76d6388e29...82.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76d6388e293de04e8ff5b3124a47cb82.exe

  • Size

    355KB

  • Sample

    211014-np5lmahae2

  • MD5

    76d6388e293de04e8ff5b3124a47cb82

  • SHA1

    a6163b93b45573b4a7792588a9fad3e8ba22ef71

  • SHA256

    694b9ea09a47c2f24b47c60ddff0a0537828e8ba964c0ad0045b9862bce37d42

  • SHA512

    00ebb1aed4182d52704cef6fadb9f81e2cffc8b8eefb6c1268113acd6fdfe882646cd4245856e30624c6bd71dc61e6d64f7230f1ebf22ebbb196446dbb078a99

Score
10/10
formbookvngbratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vngb

C2

http://www.gvlc0.club/vngb/

Decoy

omertalasvegas.com

payyep.com

modasportss.com

gestionestrategicadl.com

teamolemiss.club

geektranslate.com

versatileventure.com

athletic-hub.com

vitanovaretreats.com

padison8t.com

tutoeasy.com

ediblewholesale.com

kangrungao.com

satode.com

prohibitionfeeds.com

getmorevacations.com

blinkworldbeauty.com

kdlabsallr.com

almanasef.com

transportationservicellc.com

Targets

    • Target

      76d6388e293de04e8ff5b3124a47cb82.exe

    • Size

      355KB

    • MD5

      76d6388e293de04e8ff5b3124a47cb82

    • SHA1

      a6163b93b45573b4a7792588a9fad3e8ba22ef71

    • SHA256

      694b9ea09a47c2f24b47c60ddff0a0537828e8ba964c0ad0045b9862bce37d42

    • SHA512

      00ebb1aed4182d52704cef6fadb9f81e2cffc8b8eefb6c1268113acd6fdfe882646cd4245856e30624c6bd71dc61e6d64f7230f1ebf22ebbb196446dbb078a99

    Score
    10/10
    formbookvngbratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks