Overview

overview

10

Static

static

triage_dro...le.exe

windows7_x64

10

triage_dro...le.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    triage_dropped_file

  • Size

    874KB

  • Sample

    211023-s1y1facdb3

  • MD5

    7f6d749864243dbaab6d74dc74dc2d6c

  • SHA1

    b46866598edf54a37daf92a0526781b513733998

  • SHA256

    1e7da963a847c976589ec16cba08820882e735cdc10d07d78a391e4e63622f28

  • SHA512

    d0f38a2208f93b0f6e962204d9a0439fbedd6c51bf92ad9800200638988dd071d59c9561d5c5ec06d3be9b8b5133769995792c736c1298d38894badae7baad06

Score
10/10
formbookcnp0ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cnp0

C2

http://www.ccnsv.net/cnp0/

Decoy

jiarenyuanhunlian.com

xquizitelashesnwaxx.com

rentinerie.com

herbalpedia-id.com

openseagames.com

re-swap.com

william-cook.com

segensv.com

versebay.com

brendanlairdsound.com

bypestor.com

hospitaldelpc.net

wwwroadrunnerfinancial.com

waterhammerstudios.com

hustleandbank.photography

secure01bchslogin.com

rarepeperanking.com

greatland.company

happybirthdayjewel.com

raheok.store

Targets

    • Target

      triage_dropped_file

    • Size

      874KB

    • MD5

      7f6d749864243dbaab6d74dc74dc2d6c

    • SHA1

      b46866598edf54a37daf92a0526781b513733998

    • SHA256

      1e7da963a847c976589ec16cba08820882e735cdc10d07d78a391e4e63622f28

    • SHA512

      d0f38a2208f93b0f6e962204d9a0439fbedd6c51bf92ad9800200638988dd071d59c9561d5c5ec06d3be9b8b5133769995792c736c1298d38894badae7baad06

    Score
    10/10
    formbookcnp0ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks