Overview

overview

10

Static

static

1

c0ff9a8d77...a5.exe

windows7_x64

10

c0ff9a8d77...a5.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0ff9a8d774456c0cc9fab103ea9beb61612b4a5

  • Size

    250KB

  • Sample

    211018-q1lzrsdfd2

  • MD5

    7e5a66d60785aa472414f3d9c7cfa399

  • SHA1

    c0ff9a8d774456c0cc9fab103ea9beb61612b4a5

  • SHA256

    be576dcff77ebe92995348e2713ebef67c7503ef908f85e8227746942d2985eb

  • SHA512

    acbba3933dd9aa44c9de9d9ad23b734c0209c75d884442a3896720764584d4d1277c2c2fe605d61509fa0edfef10e7db3593e4e0f199e77dea7a639409f0b46c

Score
10/10
formbookmg0tratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mg0t

C2

http://www.q0yczwyc.asia/mg0t/

Decoy

3949842.com

webxdigital.net

dirums.online

metawiser.com

takefreepass.com

colphata.com

searchwebsafety.online

unrule.net

merch.ventures

tooreake.xyz

leonelaperu.com

qiangcai.xyz

cocco24.com

lovinganime.com

mbfad.com

historytodaygameshow.com

gadgetwellprotected.com

nutritoken-diet.com

liberty-lilies.com

singleofficial.com

Targets

    • Target

      c0ff9a8d774456c0cc9fab103ea9beb61612b4a5

    • Size

      250KB

    • MD5

      7e5a66d60785aa472414f3d9c7cfa399

    • SHA1

      c0ff9a8d774456c0cc9fab103ea9beb61612b4a5

    • SHA256

      be576dcff77ebe92995348e2713ebef67c7503ef908f85e8227746942d2985eb

    • SHA512

      acbba3933dd9aa44c9de9d9ad23b734c0209c75d884442a3896720764584d4d1277c2c2fe605d61509fa0edfef10e7db3593e4e0f199e77dea7a639409f0b46c

    Score
    10/10
    formbookmg0tratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks