Overview

overview

10

Static

static

12479bd46f...df.exe

windows7_x64

10

12479bd46f...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12479bd46f56b3e134a02c85e2d0e3df.exe

  • Size

    565KB

  • Sample

    211101-lpcjqseccp

  • MD5

    12479bd46f56b3e134a02c85e2d0e3df

  • SHA1

    cc8ed3116ff08234d5f6bd98a5fdc8f4bf07f1a5

  • SHA256

    0bbec09890d31b79c26d2b175684426630f8b243c4a210cd919e54f35572bd80

  • SHA512

    bc1d89bad911f8e0220dbcf1847d9150c3e623472d4acfeebae757ac25c74c94d2778b6fa1fcf5ec8f220d54eb50ced9ae7b083135eb1b4711ecbb10f7cbc21f

Score
10/10
formbooks18yratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s18y

C2

http://www.agentpathleurre.space/s18y/

Decoy

jokes-online.com

dzzdjn.com

lizzieerhardtebnaryepptts.com

interfacehand.xyz

sale-m.site

block-facebook.com

dicasdamadrinha.com

maythewind.com

hasari.net

omnists.com

thevalley-eg.com

rdfj.xyz

szhfcy.com

alkalineage.club

fdf.xyz

absorplus.com

poldolongo.com

badassshirts.club

ferienwohnungenmv.com

bilboondokoak.com

Targets

    • Target

      12479bd46f56b3e134a02c85e2d0e3df.exe

    • Size

      565KB

    • MD5

      12479bd46f56b3e134a02c85e2d0e3df

    • SHA1

      cc8ed3116ff08234d5f6bd98a5fdc8f4bf07f1a5

    • SHA256

      0bbec09890d31b79c26d2b175684426630f8b243c4a210cd919e54f35572bd80

    • SHA512

      bc1d89bad911f8e0220dbcf1847d9150c3e623472d4acfeebae757ac25c74c94d2778b6fa1fcf5ec8f220d54eb50ced9ae7b083135eb1b4711ecbb10f7cbc21f

    Score
    10/10
    formbooks18yratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks