Overview

overview

10

Static

static

739db143a7...91.exe

windows7_x64

1

739db143a7...91.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    739db143a714b168ad4250a12a903a91.exe
  • Size 345KB
  • Sample211014-nrqv9aghhm
  • SHA256 a68cb3bf1d9d41e29fcf2e4391e827591e58783cea5a13fe95403fb6b3429b5d
  • MD5 SHA1 SHA512
Score
10/10
formbookvngbratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • vngb

C2

  • http://www.gvlc0.club/vngb/

Decoy

  • omertalasvegas.com

  • payyep.com

  • modasportss.com

  • gestionestrategicadl.com

  • teamolemiss.club

  • geektranslate.com

  • versatileventure.com

  • athletic-hub.com

  • vitanovaretreats.com

  • padison8t.com

  • tutoeasy.com

  • ediblewholesale.com

  • kangrungao.com

  • satode.com

  • prohibitionfeeds.com

  • getmorevacations.com

  • blinkworldbeauty.com

  • kdlabsallr.com

  • almanasef.com

  • transportationservicellc.com

Targets

    • Target
      739db143a714b168ad4250a12a903a91.exe
    • Size 345KB
    • SHA256 a68cb3bf1d9d41e29fcf2e4391e827591e58783cea5a13fe95403fb6b3429b5d
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookvngbratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks