Overview

overview

10

Static

static

S.K TRADIN...NT.exe

windows7_x64

10

S.K TRADIN...NT.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    S.K TRADING CO. LTD - INQUIRY DOCUMENT.exe

  • Size

    651KB

  • Sample

    211104-ryn7saggg7

  • MD5

    49d24681bfa85de5b4b8519263c07389

  • SHA1

    52ed68d24b8e2ea0baf18e82742e42b65d1abbaa

  • SHA256

    d6a8dc15a79bd9360c26def381a088beabf9479b710001a8c1ed8d265a754f92

  • SHA512

    eb9f78770fa0ec1417a50a3f4ee3ff7393043d3cb918c4485fdcfa17c6e34c879e02314706b21c50a6bcb5846486541973889989e378cb0eeddc07d56c4a73e2

Score
10/10
formbookcnp0ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cnp0

C2

http://www.ccnsv.net/cnp0/

Decoy

jiarenyuanhunlian.com

xquizitelashesnwaxx.com

rentinerie.com

herbalpedia-id.com

openseagames.com

re-swap.com

william-cook.com

segensv.com

versebay.com

brendanlairdsound.com

bypestor.com

hospitaldelpc.net

wwwroadrunnerfinancial.com

waterhammerstudios.com

hustleandbank.photography

secure01bchslogin.com

rarepeperanking.com

greatland.company

happybirthdayjewel.com

raheok.store

Targets

    • Target

      S.K TRADING CO. LTD - INQUIRY DOCUMENT.exe

    • Size

      651KB

    • MD5

      49d24681bfa85de5b4b8519263c07389

    • SHA1

      52ed68d24b8e2ea0baf18e82742e42b65d1abbaa

    • SHA256

      d6a8dc15a79bd9360c26def381a088beabf9479b710001a8c1ed8d265a754f92

    • SHA512

      eb9f78770fa0ec1417a50a3f4ee3ff7393043d3cb918c4485fdcfa17c6e34c879e02314706b21c50a6bcb5846486541973889989e378cb0eeddc07d56c4a73e2

    Score
    10/10
    formbookcnp0ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks