Overview

overview

10

Static

static

RFQ J893- ...es.exe

windows7_x64

10

RFQ J893- ...es.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    RFQ J893- PR#28201909R1 - Supply of Alloy Pipes.exe
  • Size 583KB
  • Sample201106-ccg35phecj
  • SHA256 9fa2ffcaaf492a5d9e68b376580871cce9d495d32934d90fe7e431b09de2c6d9
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.squirewatchbands.com/vrf/

Decoy

  • emarketer.xyz

  • erinandrobert2021.com

  • naturalfemina.com

  • brittanyhertz.com

  • wwwtravelblocks.com

  • datilerabotique.com

  • termoindustrias.com

  • kilameq.info

  • cdmcigar.com

  • 2vnt33.com

  • greatstape.com

  • johannahshaven.com

  • avishparalkar.net

  • jdjmijou.club

  • kechevere.com

  • blackstonedynamics.com

  • bomoolah.com

  • creditomedico.com

  • zerongjd.com

  • nyysnkee.com

Targets

    • Target
      RFQ J893- PR#28201909R1 - Supply of Alloy Pipes.exe
    • Size 583KB
    • SHA256 9fa2ffcaaf492a5d9e68b376580871cce9d495d32934d90fe7e431b09de2c6d9
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks