Overview

overview

10

Static

static

476f7ccfae...d5.exe

windows7_x64

10

476f7ccfae...d5.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    476f7ccfae367d3a1379c260ca28b8d5
  • Size 357KB
  • Sample211116-ngncdaaebn
  • SHA256 839377fd0aa17abb875ab6d090738390fc33219fa7b60b753f17e642165347a0
  • MD5 SHA1 SHA512
Score
10/10
formbooke5dnratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • e5dn

C2

  • http://www.elpasomedicare.com/e5dn/

Decoy

  • reinvestorreturns.com

  • storyoftheuniverse.net

  • sogholon.com

  • amazonjobs.money

  • justshopp.online

  • markhodsoncoaching.com

  • bielaypiston.com

  • markthemillwright.com

  • tiding.pro

  • qthspjs.com

  • digitalbizplan.com

  • hitchhiking.sbs

  • rsinewa.xyz

  • skecherushop.com

  • dism.group

  • shibavelas.com

  • therecoveryclub.store

  • digitalisimo.xyz

  • blingthingboutiquellc.com

  • dbmm.xyz

Targets

    • Target
      476f7ccfae367d3a1379c260ca28b8d5
    • Size 357KB
    • SHA256 839377fd0aa17abb875ab6d090738390fc33219fa7b60b753f17e642165347a0
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooke5dnratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks