Overview

overview

10

Static

static

d3d6e929e6...b5.exe

windows7_x64

10

d3d6e929e6...b5.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    d3d6e929e69888a2da043aae57adfdb5.exe
  • Size 757KB
  • Sample210910-rrw9taaca3
  • SHA256 4e574ffdb3aba06f7e3aaebd9293eaf171289304e7fdd8ecfbf8275a149eba1d
  • MD5 SHA1 SHA512
Score
10/10
formbookbcktratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • bckt

C2

  • http://www.wonderspirits.com/bckt/

Decoy

  • soarabroad.com

  • ddd800.com

  • julesreedy.design

  • serversidecookies.com

  • mortgagerefinancinginc.com

  • procurein.com

  • futwoz.com

  • photopareliulko.com

  • kaelmisko.com

  • elite-on.net

  • raphainfosec.com

  • bestscatvideo.com

  • 8785525.com

  • crisppdata.com

  • criminalmindeddesign.com

  • efurniturekart.com

  • enigmasqueaks.com

  • inteleflow.com

  • cr-marketing.com

  • electrumonline.codes

Targets

    • Target
      d3d6e929e69888a2da043aae57adfdb5.exe
    • Size 757KB
    • SHA256 4e574ffdb3aba06f7e3aaebd9293eaf171289304e7fdd8ecfbf8275a149eba1d
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookbcktratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks