Overview

overview

10

Static

static

1

3202470053...75.exe

windows7_x64

10

3202470053...75.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3202470053412fe3bf830321ad225d75

  • Size

    459KB

  • Sample

    211118-m3z3macedk

  • MD5

    3202470053412fe3bf830321ad225d75

  • SHA1

    5c28c36a3bd05c02b135f641bf5195b8c9b960b9

  • SHA256

    936a3e9dfd299c365c2de9e998f6858f4329378fcbeea90b940b98d2eaa1d152

  • SHA512

    8a2cdc7ee77cbb2aa0509732bb5f2ba832f621c70df772a266afa7810bf8704bb4d26d2f19b4b8b4b7257dbde600f6461797bef112c9b1d9895bf099827d59ae

Score
10/10
formbookog2wratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

og2w

C2

http://www.celikkaya.xyz/og2w/

Decoy

drivenexpress.info

pdfproxy.com

zyz999.top

oceanserver1.com

948289.com

nubilewoman.com

ibizadiamonds.com

bosniantv-australia.com

juliehutzell.com

poshesocial.events

icsrwk.xyz

nap-con.com

womansslippers.com

invictusfarm.com

search-panel-avg-rock.rest

desencriptar.com

imperialexoticreptiles.com

agastify.com

strinvstr.com

julianapeloi.com

Targets

    • Target

      3202470053412fe3bf830321ad225d75

    • Size

      459KB

    • MD5

      3202470053412fe3bf830321ad225d75

    • SHA1

      5c28c36a3bd05c02b135f641bf5195b8c9b960b9

    • SHA256

      936a3e9dfd299c365c2de9e998f6858f4329378fcbeea90b940b98d2eaa1d152

    • SHA512

      8a2cdc7ee77cbb2aa0509732bb5f2ba832f621c70df772a266afa7810bf8704bb4d26d2f19b4b8b4b7257dbde600f6461797bef112c9b1d9895bf099827d59ae

    Score
    10/10
    formbookog2wratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks