Overview

overview

10

Static

static

9f61af191c...9f.exe

windows7_x64

10

9f61af191c...9f.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9f61af191c20dc0eb90a92558e74059f
  • Size 1.1MB
  • Sample210802-2pl6b1d222
  • SHA256 b21eb6d14eae70e233132e7fa4e99fb282209f1c6ea8ba4d984e9585ee965e87
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

C2

  • http://www.fortmyerscruisevacation.com/dd2v/

Decoy

  • jkrqzmeyd.icu

  • cbluedottvwdshop.com

  • yhchen.space

  • premierhealthnwellness.com

  • szkuyaju.com

  • harvestmoonloans.net

  • dadematerial.com

  • mariaclarahairstudio.com

  • hwunvy.online

  • puloutjbmere.com

  • kossu1989.com

  • dubbedos.com

  • ncylis.com

  • hybrid-sol.com

  • travelature.com

  • gracefulcounts.com

  • 66secretgarden.com

  • eslonyourcell.com

  • wisersponsorship.com

  • sepn3.com

Targets

    • Target
      9f61af191c20dc0eb90a92558e74059f
    • Size 1.1MB
    • SHA256 b21eb6d14eae70e233132e7fa4e99fb282209f1c6ea8ba4d984e9585ee965e87
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks