Overview

overview

10

Static

static

70b00a6a05...31.exe

windows7_x64

10

70b00a6a05...31.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70b00a6a05ad968af28f6b303d38f231.exe

  • Size

    413KB

  • Sample

    211030-jgmzdsbchr

  • MD5

    70b00a6a05ad968af28f6b303d38f231

  • SHA1

    e51873233e79851d7ee46d1f5553cf2b4d60098d

  • SHA256

    be61aba2c5d56a20b50c5f4a682087840876fdf7504fbf5eb8ac56a0e572fb33

  • SHA512

    d81b86c15212f716c87f79fa9dc1214ac09d5f93eb109e014b13cd4adcf33413747df4b2356d7de7add21e35c4c1def163ac39edd368a2581e54a1ade87f2800

Score
10/10
formbooks18yratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s18y

C2

http://www.agentpathleurre.space/s18y/

Decoy

jokes-online.com

dzzdjn.com

lizzieerhardtebnaryepptts.com

interfacehand.xyz

sale-m.site

block-facebook.com

dicasdamadrinha.com

maythewind.com

hasari.net

omnists.com

thevalley-eg.com

rdfj.xyz

szhfcy.com

alkalineage.club

fdf.xyz

absorplus.com

poldolongo.com

badassshirts.club

ferienwohnungenmv.com

bilboondokoak.com

Targets

    • Target

      70b00a6a05ad968af28f6b303d38f231.exe

    • Size

      413KB

    • MD5

      70b00a6a05ad968af28f6b303d38f231

    • SHA1

      e51873233e79851d7ee46d1f5553cf2b4d60098d

    • SHA256

      be61aba2c5d56a20b50c5f4a682087840876fdf7504fbf5eb8ac56a0e572fb33

    • SHA512

      d81b86c15212f716c87f79fa9dc1214ac09d5f93eb109e014b13cd4adcf33413747df4b2356d7de7add21e35c4c1def163ac39edd368a2581e54a1ade87f2800

    Score
    10/10
    formbooks18yratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks