Overview

overview

10

Static

static

a183768631...ae.exe

windows7_x64

10

a183768631...ae.exe

windows10_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    a183768631f68d124acdc41ae7f952ae
  • Size 367KB
  • Sample211112-ndp2ssdcf8
  • SHA256 4bde2d0abed748c6fb8620ab890cbb09fa5749c4ef749e8cd5c6c7dd40cfd37b
  • MD5 SHA1 SHA512
Score
10/10
formbook9gr5ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • 9gr5

C2

  • http://www.cuteprofessionalscrubs.com/9gr5/

Decoy

  • newleafcosmetix.com

  • richermanscastle.com

  • ru-remonton.com

  • 2diandongche.com

  • federaldados.design

  • jeffreycookweb.com

  • facecs.online

  • xmeclarn.xyz

  • olgasmith.xyz

  • sneakersonlinesale.com

  • playboyshiba.com

  • angelamiglioli.com

  • diitaldefynd.com

  • whenevergames.com

  • mtheartcustom.com

  • vitalactivesupply.com

  • twistblogr.com

  • xn--i8s140at3d6u7c.tel

  • baudelaireelhakim.com

  • real-estate-miami-searcher.site

Targets

    • Target
      a183768631f68d124acdc41ae7f952ae
    • Size 367KB
    • SHA256 4bde2d0abed748c6fb8620ab890cbb09fa5749c4ef749e8cd5c6c7dd40cfd37b
    • MD5 SHA1 SHA512
    Score
    10/10
    formbook9gr5ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks