Overview

overview

10

Static

static

c71f136a10...f6.exe

windows7_x64

10

c71f136a10...f6.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c71f136a10c7c2f067f0a551a48f8ff6
  • Size 886KB
  • Sample210706-ryfw9se35x
  • SHA256 8a8cc0347be5e13c27bbb82822db989e8c47896d8e23944a8f5f419f4b6989ee
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

C2

  • http://www.share-event.info/wlns/

Decoy

  • travelagentngapali.com

  • cassandraclub.com

  • yuanhenghuanwei.com

  • rellimsewil.com

  • servingsunshine.com

  • guniverse.net

  • livingonresidual.net

  • fourmid.com

  • batesandmills.com

  • produtos-servicos.website

  • pokemonteambuilder.team

  • ticeye.com

  • latituderc.com

  • xn--ok0bv0wfrj.com

  • strinix.com

  • nycmama.com

  • sljy8888.com

  • lifeinsurancerd.com

  • osdbapi.com

  • xydwnzavp.asia

Targets

    • Target
      c71f136a10c7c2f067f0a551a48f8ff6
    • Size 886KB
    • SHA256 8a8cc0347be5e13c27bbb82822db989e8c47896d8e23944a8f5f419f4b6989ee
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks