Overview

overview

10

Static

static

1

586f7a1895...33.exe

windows7_x64

10

586f7a1895...33.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    586f7a1895ea47a462b1d5f6a43fcd33
  • Size 309KB
  • Sample211124-yq1deaggf3
  • SHA256 1358d88e078f1c59b546256968179bf213928f1e6f4e7afa255681b2cd8f92a2
  • MD5 SHA1 SHA512
Score
10/10
formbookvngbratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • vngb

C2

  • http://www.gvlc0.club/vngb/

Decoy

  • omertalasvegas.com

  • payyep.com

  • modasportss.com

  • gestionestrategicadl.com

  • teamolemiss.club

  • geektranslate.com

  • versatileventure.com

  • athletic-hub.com

  • vitanovaretreats.com

  • padison8t.com

  • tutoeasy.com

  • ediblewholesale.com

  • kangrungao.com

  • satode.com

  • prohibitionfeeds.com

  • getmorevacations.com

  • blinkworldbeauty.com

  • kdlabsallr.com

  • almanasef.com

  • transportationservicellc.com

Targets

    • Target
      586f7a1895ea47a462b1d5f6a43fcd33
    • Size 309KB
    • SHA256 1358d88e078f1c59b546256968179bf213928f1e6f4e7afa255681b2cd8f92a2
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookvngbratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks