Overview

overview

10

Static

static

06ff0fff9d...c2.exe

windows7_x64

10

06ff0fff9d...c2.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    06ff0fff9de08e2cca89bc274bc5a2c2
  • Size 708KB
  • Sample201117-447pfg6ehj
  • SHA256 c698f5ef823adc2c3079ee359ea6d80e7c8e800d742d8f63c4c6f697131dd763
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.thehappyhourtimes.com/z0po/

Decoy

  • trouverunartisanserieux.com

  • dawn-niece.xyz

  • smalltree2021.com

  • asiansforliberty.com

  • suyeaimwnd.com

  • 67630pp.com

  • drinkdeliveryservices.com

  • icollect-auctions.com

  • transformintecture.com

  • systemaircn.com

  • bluemonkeyhealingenergy.com

  • joebartonproducts.com

  • sacredclouddesigns.com

  • discovertravelco.com

  • haxb33.xyz

  • soldadorprofissional.com

  • disruptergen.com

  • senvias12.com

  • culinaryrambler.net

  • hnhlsm.com

Targets

    • Target
      06ff0fff9de08e2cca89bc274bc5a2c2
    • Size 708KB
    • SHA256 c698f5ef823adc2c3079ee359ea6d80e7c8e800d742d8f63c4c6f697131dd763
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks