Overview

overview

10

Static

static

3657b2f21c...9c.exe

windows7_x64

10

3657b2f21c...9c.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3657b2f21cfdc84bc53eee638ccef99c.exe
  • Size 669KB
  • Sample210903-p2cxtagcbr
  • SHA256 c474dc9d81e08842f527487d032551b0d86e95a0f32fa2ebc7375fdb740c7e42
  • MD5 SHA1 SHA512
Score
10/10
formbookbcktratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • bckt

C2

  • http://www.wonderspirits.com/bckt/

Decoy

  • soarabroad.com

  • ddd800.com

  • julesreedy.design

  • serversidecookies.com

  • mortgagerefinancinginc.com

  • procurein.com

  • futwoz.com

  • photopareliulko.com

  • kaelmisko.com

  • elite-on.net

  • raphainfosec.com

  • bestscatvideo.com

  • 8785525.com

  • crisppdata.com

  • criminalmindeddesign.com

  • efurniturekart.com

  • enigmasqueaks.com

  • inteleflow.com

  • cr-marketing.com

  • electrumonline.codes

Targets

    • Target
      3657b2f21cfdc84bc53eee638ccef99c.exe
    • Size 669KB
    • SHA256 c474dc9d81e08842f527487d032551b0d86e95a0f32fa2ebc7375fdb740c7e42
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookbcktratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks