Overview

overview

10

Static

static

1762e252c0...89.exe

windows7_x64

10

1762e252c0...89.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    1762e252c0b3c0fa4690e7a4f829a989.exe
  • Size 878KB
  • Sample210908-m45phahedn
  • SHA256 a56e9e3fc6d7b412b1e9cf5dff739358849779b3c80df268ade3d9da79bd5da5
  • MD5 SHA1 SHA512
Score
10/10
formbookgz92ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • gz92

C2

  • http://www.peggeorge.com/gz92/

Decoy

  • ayurvedichealthformulas.com

  • plazaconstrutora.com

  • nat-hetong.info

  • eapdigital.com

  • ibluebaytvwdshop.com

  • committable.com

  • escapesbyek.com

  • mywebdesigner.pro

  • jianianhong.com

  • benvenutoqui.com

  • beiyet.com

  • theartofgifs.com

  • mbwvyksnk.icu

  • nshahwelfare.com

  • hhhservice.com

  • thechaibali.com

  • travelscreen.expert

  • best123-movies.com

  • leiahin.com

  • runplay11.com

Targets

    • Target
      1762e252c0b3c0fa4690e7a4f829a989.exe
    • Size 878KB
    • SHA256 a56e9e3fc6d7b412b1e9cf5dff739358849779b3c80df268ade3d9da79bd5da5
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookgz92ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks