Overview

overview

10

Static

static

6430a88a4b...0e.exe

windows7_x64

10

6430a88a4b...0e.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6430a88a4b8966baf1537d011d1a7b0e.exe
  • Size 918KB
  • Sample210205-qejwkfr5ce
  • SHA256 ae6a16d4082c3082ad60db5ea9715ea44bbff9a97a5b751cb01d351230a5fc42
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.theatomicshots.com/xle/

Decoy

  • tknbr.com

  • loyaloneconstruction.com

  • what-where.com

  • matebacapital.com

  • marriedandmore.com

  • qiemfsolutions.com

  • graececonsulting.com

  • www7456.com

  • littlefreecherokeelibrary.com

  • tailgatepawkinglot.com

  • musheet.com

  • tesfamariamtb.com

  • 1728025.com

  • xceltechuae.com

  • harperandchloe.com

  • thepamperedbarber.com

  • 5050alberta.com

  • supplychainstrainer.com

  • lacorte.group

  • ringingbear.com

Targets

    • Target
      6430a88a4b8966baf1537d011d1a7b0e.exe
    • Size 918KB
    • SHA256 ae6a16d4082c3082ad60db5ea9715ea44bbff9a97a5b751cb01d351230a5fc42
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks