Overview

overview

10

Static

static

1

e424558e20...6a.exe

windows7_x64

10

e424558e20...6a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e424558e20ed8cf4da62dea3b4633af6acd5c76a

  • Size

    298KB

  • Sample

    211126-m4xznabhfl

  • MD5

    1a5ca5189741f2c19b37636cc75b4287

  • SHA1

    e424558e20ed8cf4da62dea3b4633af6acd5c76a

  • SHA256

    c99e87423f7904055d6d9b0952ae05f17dae342dd13618892a272e8805f0609b

  • SHA512

    712b9567e95c795e83be25a9beafea096901e4ffc2830d165a747eca3d54a11360401e3dac4c29c0248d47640fa2898093b27c3dc9e0a8ee2cb92ca1424eca82

Score
10/10
formbookdn7rratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Targets

    • Target

      e424558e20ed8cf4da62dea3b4633af6acd5c76a

    • Size

      298KB

    • MD5

      1a5ca5189741f2c19b37636cc75b4287

    • SHA1

      e424558e20ed8cf4da62dea3b4633af6acd5c76a

    • SHA256

      c99e87423f7904055d6d9b0952ae05f17dae342dd13618892a272e8805f0609b

    • SHA512

      712b9567e95c795e83be25a9beafea096901e4ffc2830d165a747eca3d54a11360401e3dac4c29c0248d47640fa2898093b27c3dc9e0a8ee2cb92ca1424eca82

    Score
    10/10
    formbookdn7rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks