Overview

overview

10

Static

static

S.K TRADIN...TS.exe

windows7_x64

10

S.K TRADIN...TS.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    S.K TRADING CO., LTD - INQUIRY DOCUMENTS.exe

  • Size

    448KB

  • Sample

    211104-n1qxlsgee3

  • MD5

    78be75029064bfcd03eedce61e018d9b

  • SHA1

    5b9594d4dc4c46d5479ed5645ba1aa510e403ec3

  • SHA256

    7dd2cb6cb441739419634c8a5aedbd44fc20357fe1c861924b3199e5f4e351ba

  • SHA512

    256433af256e230521998b0bf48921f4ccb6cf4d113409b4678c0c36709c431dcb257b01f0d8842a041447e117bf070cef9b300975d24793b1a52525dcc16547

Score
10/10
formbookcnp0ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cnp0

C2

http://www.ccnsv.net/cnp0/

Decoy

jiarenyuanhunlian.com

xquizitelashesnwaxx.com

rentinerie.com

herbalpedia-id.com

openseagames.com

re-swap.com

william-cook.com

segensv.com

versebay.com

brendanlairdsound.com

bypestor.com

hospitaldelpc.net

wwwroadrunnerfinancial.com

waterhammerstudios.com

hustleandbank.photography

secure01bchslogin.com

rarepeperanking.com

greatland.company

happybirthdayjewel.com

raheok.store

Targets

    • Target

      S.K TRADING CO., LTD - INQUIRY DOCUMENTS.exe

    • Size

      448KB

    • MD5

      78be75029064bfcd03eedce61e018d9b

    • SHA1

      5b9594d4dc4c46d5479ed5645ba1aa510e403ec3

    • SHA256

      7dd2cb6cb441739419634c8a5aedbd44fc20357fe1c861924b3199e5f4e351ba

    • SHA512

      256433af256e230521998b0bf48921f4ccb6cf4d113409b4678c0c36709c431dcb257b01f0d8842a041447e117bf070cef9b300975d24793b1a52525dcc16547

    Score
    10/10
    formbookcnp0ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks