Overview

overview

10

Static

static

806f81ab86...6c.exe

windows7_x64

10

806f81ab86...6c.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    806f81ab862618774ee7a5a197af916c.exe
  • Size 968KB
  • Sample210119-erhf2v7kh2
  • SHA256 182fd1343975d43f456f199f379210d562d15ea3c8e4c7bd59899d75c18a2fe9
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.aftabzahur.com/wgn/

Decoy

  • kokokara-life-blog.com

  • faswear.com

  • futureleadershiptoday.com

  • date4done.xyz

  • thecouponinn.com

  • bbeycarpetsf.com

  • propolisnasalspray.com

  • jinjudiamond.com

  • goodevectors.com

  • nehyam.com

  • evalinkapuppets.com

  • what-if-statistics.com

  • rateofrisk.com

  • impacttestonlinne.com

  • servis-kaydet.info

  • coloniacafe.com

  • marcemarketing.com

  • aarigging.com

  • goddesswitchery.com

  • jasqblo.icu

Targets

    • Target
      806f81ab862618774ee7a5a197af916c.exe
    • Size 968KB
    • SHA256 182fd1343975d43f456f199f379210d562d15ea3c8e4c7bd59899d75c18a2fe9
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks