Overview

overview

10

Static

static

0729d18773...05.exe

windows7_x64

1

0729d18773...05.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0729d187737ac21905310fc105436605
  • Size 1.2MB
  • Sample211116-j8z32achd2
  • SHA256 dd6dba0589aac8951a4ddc6bcbbbf76f478b1df4ef93e6f1df0bd789f560d32a
  • MD5 SHA1 SHA512
Score
10/10
formbooke5dnratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • e5dn

C2

  • http://www.elpasomedicare.com/e5dn/

Decoy

  • reinvestorreturns.com

  • storyoftheuniverse.net

  • sogholon.com

  • amazonjobs.money

  • justshopp.online

  • markhodsoncoaching.com

  • bielaypiston.com

  • markthemillwright.com

  • tiding.pro

  • qthspjs.com

  • digitalbizplan.com

  • hitchhiking.sbs

  • rsinewa.xyz

  • skecherushop.com

  • dism.group

  • shibavelas.com

  • therecoveryclub.store

  • digitalisimo.xyz

  • blingthingboutiquellc.com

  • dbmm.xyz

Targets

    • Target
      0729d187737ac21905310fc105436605
    • Size 1.2MB
    • SHA256 dd6dba0589aac8951a4ddc6bcbbbf76f478b1df4ef93e6f1df0bd789f560d32a
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooke5dnratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks