Overview

overview

10

Static

static

b453431bd7...b4.exe

windows7_x64

10

b453431bd7...b4.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b453431bd73d0333530edd13f38089b4
  • Size 476KB
  • Sample211129-v2569aceam
  • SHA256 71b4619d3dd4bb8e3619a2ebfe39f71c728d0d723992e44c8564dab8e8035b28
  • MD5 SHA1 SHA512
Score
10/10
formbooknqm8ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • nqm8

C2

  • http://www.mmsite.site/nqm8/

Decoy

  • gr8leiloes.com

  • workali.com

  • tom641220480.online

  • metaversehome.tech

  • aljinternationalcorp.com

  • drofekt.com

  • landmanagementdirtworksnwar.com

  • liaslaton.com

  • hanswelliot.com

  • sterling2.xyz

  • metatock.com

  • tnbankauctionproperties.com

  • 366466.com

  • g1ft-portal.net

  • highlandsdg.com

  • letsgorebranding.com

  • tc76.xyz

  • colo2022.xyz

  • reikicertificationcourses.info

  • metawks.com

Targets

    • Target
      b453431bd73d0333530edd13f38089b4
    • Size 476KB
    • SHA256 71b4619d3dd4bb8e3619a2ebfe39f71c728d0d723992e44c8564dab8e8035b28
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooknqm8ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks