Overview

overview

10

Static

static

1

d8243c4006...4b.exe

windows7_x64

10

d8243c4006...4b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d8243c40062434c86d4aa8de70f8895871d32d4b

  • Size

    292KB

  • Sample

    211129-p37htafbc5

  • MD5

    23e736651b0197f57e8fd44d7cfc4b52

  • SHA1

    d8243c40062434c86d4aa8de70f8895871d32d4b

  • SHA256

    829f3833979533db54e1506712ee25ed2c34ec701a4d156ffa2ecf1a71499101

  • SHA512

    c28038c157699847dfa8ababf7029c3bf38b854fc0821d0bf6dba230ae10c87def0e779f93463be93dd9b9f37d7c8fc48c86f22dc296f576956450f669a14b4e

Score
10/10
formbookmg0tratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mg0t

C2

http://www.q0yczwyc.asia/mg0t/

Decoy

3949842.com

webxdigital.net

dirums.online

metawiser.com

takefreepass.com

colphata.com

searchwebsafety.online

unrule.net

merch.ventures

tooreake.xyz

leonelaperu.com

qiangcai.xyz

cocco24.com

lovinganime.com

mbfad.com

historytodaygameshow.com

gadgetwellprotected.com

nutritoken-diet.com

liberty-lilies.com

singleofficial.com

Targets

    • Target

      d8243c40062434c86d4aa8de70f8895871d32d4b

    • Size

      292KB

    • MD5

      23e736651b0197f57e8fd44d7cfc4b52

    • SHA1

      d8243c40062434c86d4aa8de70f8895871d32d4b

    • SHA256

      829f3833979533db54e1506712ee25ed2c34ec701a4d156ffa2ecf1a71499101

    • SHA512

      c28038c157699847dfa8ababf7029c3bf38b854fc0821d0bf6dba230ae10c87def0e779f93463be93dd9b9f37d7c8fc48c86f22dc296f576956450f669a14b4e

    Score
    10/10
    formbookmg0tratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks