Overview

overview

10

Static

static

su7KUpCZ70l2fSb.exe

windows7_x64

10

su7KUpCZ70l2fSb.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    su7KUpCZ70l2fSb.exe

  • Size

    504KB

  • Sample

    211019-hsr7tafda6

  • MD5

    c5af3ffcbffc142f31dacc040fcc5d35

  • SHA1

    255eda5bb10ee964c86d70c8e8b4358f207cf6fd

  • SHA256

    fc79ac22a40cdc6c5bb5581cdbfde9a72fab2034bcfb1ca04208d5ed5ee0f2cd

  • SHA512

    11e2d2a9aa0ea2901a84499a3d06f54b223e69c3c91af12649a02e905376568e7332ee803754761bf50b05f72e42a91e23daa794c0af483a8c65a47097ed25de

Score
10/10
formbookpn4rratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pn4r

C2

http://www.wexchange.money/pn4r/

Decoy

mymicroreader.com

rpttoday.com

covid-testiranje.com

trendismon.com

xtoearn.com

themiraclemamma.com

reebok-technology.store

naionics.com

nuatierra.com

tarynrenee.com

tessstrachey.xyz

ptarmigan.xyz

publistom.com

hostingforyou.online

padellacentral.com

vp0y0x.icu

theultimatewhisper.com

fashionbrandsweek.com

soltechwebdesign.site

proteinakua.net

Targets

    • Target

      su7KUpCZ70l2fSb.exe

    • Size

      504KB

    • MD5

      c5af3ffcbffc142f31dacc040fcc5d35

    • SHA1

      255eda5bb10ee964c86d70c8e8b4358f207cf6fd

    • SHA256

      fc79ac22a40cdc6c5bb5581cdbfde9a72fab2034bcfb1ca04208d5ed5ee0f2cd

    • SHA512

      11e2d2a9aa0ea2901a84499a3d06f54b223e69c3c91af12649a02e905376568e7332ee803754761bf50b05f72e42a91e23daa794c0af483a8c65a47097ed25de

    Score
    10/10
    formbookpn4rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks