Overview

overview

10

Static

static

1b409f19f1...99.exe

windows7_x64

10

1b409f19f1...99.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1b409f19f166463379e0211aced1af99

  • Size

    348KB

  • Sample

    211026-yfwbpsaca9

  • MD5

    1b409f19f166463379e0211aced1af99

  • SHA1

    d15127da7d1de660a66e9062c81131d9c3fd9d4b

  • SHA256

    a2dd12adec362ce7457da7795a1b0505dc2c88ab322a1c59637e8196528739f0

  • SHA512

    8d7f1b7814daae7e77334524a6ecfc12c401b94a62e10fbddb5928af87af83d37885ece12b5d95228ad5314209c201348a1b44d5dadd6661fae5e4a050786e65

Score
10/10
formbookjy0bratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jy0b

C2

http://www.filecrev.com/jy0b/

Decoy

lamejorimagen.com

mykabukibrush.com

modgon.com

barefoottherapeutics.com

shimpeg.net

trade-sniper.com

chiangkhancityhotel.com

joblessmoni.club

stespritsubways.com

chico-group.com

nni8.xyz

searchtypically.online

jobsyork.com

bestsales-crypto.com

iqmarketing.info

bullcityphotobooths.com

fwssc.icu

1oc87s.icu

usdiesel.xyz

secrets2optimumnutrition.com

Targets

    • Target

      1b409f19f166463379e0211aced1af99

    • Size

      348KB

    • MD5

      1b409f19f166463379e0211aced1af99

    • SHA1

      d15127da7d1de660a66e9062c81131d9c3fd9d4b

    • SHA256

      a2dd12adec362ce7457da7795a1b0505dc2c88ab322a1c59637e8196528739f0

    • SHA512

      8d7f1b7814daae7e77334524a6ecfc12c401b94a62e10fbddb5928af87af83d37885ece12b5d95228ad5314209c201348a1b44d5dadd6661fae5e4a050786e65

    Score
    10/10
    formbookjy0bratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks