Overview

overview

10

Static

static

3.exe

windows7_x64

10

3.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3.exe

  • Size

    405KB

  • Sample

    211029-kfwetachg9

  • MD5

    178524c151b05288c04e0f775cf58730

  • SHA1

    f7913f293a669b12f5eb6ed9cd5bbc73d7dc4c08

  • SHA256

    11061f2489d810c91ae445ebe65eb28c16939836e609e2fac508546cfacdfa26

  • SHA512

    293ebd1ce654ef5f19457c616b1b8f95181c687c1af11243eb83ced3e3238a901ceea822b515ce2d8668529b9c46ccc4209e4dd546c7f059127b8452ee4b6470

Score
10/10
formbookjy0bratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jy0b

C2

http://www.filecrev.com/jy0b/

Decoy

lamejorimagen.com

mykabukibrush.com

modgon.com

barefoottherapeutics.com

shimpeg.net

trade-sniper.com

chiangkhancityhotel.com

joblessmoni.club

stespritsubways.com

chico-group.com

nni8.xyz

searchtypically.online

jobsyork.com

bestsales-crypto.com

iqmarketing.info

bullcityphotobooths.com

fwssc.icu

1oc87s.icu

usdiesel.xyz

secrets2optimumnutrition.com

Targets

    • Target

      3.exe

    • Size

      405KB

    • MD5

      178524c151b05288c04e0f775cf58730

    • SHA1

      f7913f293a669b12f5eb6ed9cd5bbc73d7dc4c08

    • SHA256

      11061f2489d810c91ae445ebe65eb28c16939836e609e2fac508546cfacdfa26

    • SHA512

      293ebd1ce654ef5f19457c616b1b8f95181c687c1af11243eb83ced3e3238a901ceea822b515ce2d8668529b9c46ccc4209e4dd546c7f059127b8452ee4b6470

    Score
    10/10
    formbookjy0bratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks