Overview

overview

10

Static

static

Germany or...cr.exe

windows7-x64

10

Germany or...cr.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Germany order.pdf.scr.exe

  • Size

    695KB

  • Sample

    220812-q3313adhdj

  • MD5

    6e6d1e67f50d4e4eebc3a092eb188aeb

  • SHA1

    633ae9760801d8f09fb4d86e757b1719cc83b971

  • SHA256

    97708b8220f28c8a7f5d9ea61f79bc21a86e1efb9932fa64b503636b85393746

  • SHA512

    779bd7aaa2dd26052418e3408c3097d20c03b2c6e8ab2754eb355e8e166aedf1232c99653bc79ee9e1c02c5291f128d9f60a4377fbedd9a9663430397d14c628

Score
10/10
formbookp94aratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

p94a

Decoy

wishgrove.com

parqueveiculos.com

spiderwebs.online

chulkanadham.com

cdtuan.net

zxazm.com

payment6528832.xyz

fengtaiol.com

bffsmovie.com

aliceseagerfitness.com

garisluruskonsulindo.website

analytical-gutter.net

ahcq8.com

fenyoga.com

ecleptic.cat

conjurecrafts.com

aquaway.date

apenpokkenschoonmaakbedrijf.com

zgramr.top

boweknives.site

Targets

    • Target

      Germany order.pdf.scr.exe

    • Size

      695KB

    • MD5

      6e6d1e67f50d4e4eebc3a092eb188aeb

    • SHA1

      633ae9760801d8f09fb4d86e757b1719cc83b971

    • SHA256

      97708b8220f28c8a7f5d9ea61f79bc21a86e1efb9932fa64b503636b85393746

    • SHA512

      779bd7aaa2dd26052418e3408c3097d20c03b2c6e8ab2754eb355e8e166aedf1232c99653bc79ee9e1c02c5291f128d9f60a4377fbedd9a9663430397d14c628

    Score
    10/10
    formbookp94aratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks