Overview

overview

10

Static

static

3

kpCSGLBxAw2RnrW.exe

windows7-x64

10

kpCSGLBxAw2RnrW.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    kpCSGLBxAw2RnrW.exe
  • Size 792KB
  • Sample240701-l5m1eavfra
  • SHA256 8d39599a31cac2a8cf51d0b0d6dfd6dbafa76dd1cd33d70d0ce6a8235c662a5d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookdy13ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • dy13

Decoy

  • manga-house.com

  • kjsdhklssk51.xyz

  • b0ba138.xyz

  • bt365033.com

  • ccbsinc.net

  • mrwine.xyz

  • nrxkrd527o.xyz

  • hoshi.social

  • 1912ai.com

  • serco2020.com

  • byfchfyr.xyz

  • imuschestvostorgov.online

  • austinheafey.com

  • mrdfa.club

  • 883106.photos

  • profitablefxmarkets.com

  • taini00.net

  • brye.top

  • ginsm.com

  • sportglid.com

Targets

    • Target
      kpCSGLBxAw2RnrW.exe
    • Size 792KB
    • SHA256 8d39599a31cac2a8cf51d0b0d6dfd6dbafa76dd1cd33d70d0ce6a8235c662a5d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookdy13ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks