Overview

overview

10

Static

static

5108116c82...d3.exe

windows7-x64

10

5108116c82...d3.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5108116c82b8162763aaf8bc8cad549d0fcde544bc021d9657605176b2deb2d3

  • Size

    996KB

  • Sample

    220718-w2evqscge7

  • MD5

    1eb32c7014661d6698c72be1e13cd48a

  • SHA1

    9034b92cbdd575153da93e6e299fef7ad5da19c4

  • SHA256

    5108116c82b8162763aaf8bc8cad549d0fcde544bc021d9657605176b2deb2d3

  • SHA512

    4bc5bf886a0c9c8eb0b9216a4acfeeca27435af651ec8f87d623f91b32e66ad63dcd063d382c3a59561c228f3342b1896424910fa5b155562424727af9e287e3

Score
10/10
formbooknetwirejs3botnetratspywarestealertrojan

Malware Config

Extracted

Family

netwire

C2

dinesaad.hopto.org:8123

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Extracted

Family

formbook

Version

3.8

Campaign

js3

Decoy

mk-autopflege.com

samanthawipulasinhe.com

hbzxcdc.com

lmcdecorating.com

e-spirit-technologies.com

dragonballgame.com

schedulerapp.info

heavenlyscentusa.com

malrohservice.com

vapmoda.com

elenasvoice.com

bogs.finance

heartworkdesigns.com

onportraits.com

clienteleventures.com

syxfzdj.com

conalider.com

zyd-touch.com

louisianetrotobas.com

zwoyi.info

Targets

    • Target

      5108116c82b8162763aaf8bc8cad549d0fcde544bc021d9657605176b2deb2d3

    • Size

      996KB

    • MD5

      1eb32c7014661d6698c72be1e13cd48a

    • SHA1

      9034b92cbdd575153da93e6e299fef7ad5da19c4

    • SHA256

      5108116c82b8162763aaf8bc8cad549d0fcde544bc021d9657605176b2deb2d3

    • SHA512

      4bc5bf886a0c9c8eb0b9216a4acfeeca27435af651ec8f87d623f91b32e66ad63dcd063d382c3a59561c228f3342b1896424910fa5b155562424727af9e287e3

    Score
    10/10
    formbooknetwirejs3botnetratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Formbook payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks