Overview

overview

10

Static

static

Bdcuhmcgbs...mk.exe

windows7_x64

10

Bdcuhmcgbs...mk.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Bdcuhmcgbsvmxhmuasrulqqnfbjdnogomk.exe
  • Size 814KB
  • Sample210911-tcsdesbec4
  • SHA256 4d80ab79360b092bb5d8fa41d14388dffe5ef42839b6dbbf741f0ce5c3424d1e
  • MD5 SHA1 SHA512
Score
10/10
formbook3nopratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • 3nop

C2

  • http://www.jakesplacebarbers.com/3nop/

Decoy

  • videohm.com

  • panache-rose.com

  • alnooncars-kw.com

  • trueblue2u.com

  • brussels-cafe.com

  • ip2c.net

  • influenzerr.com

  • rbcoq.com

  • zzful.com

  • drainthe.com

  • sumaholesson.com

  • cursosaprovados.com

  • genotecinc.com

  • dbrulhart.com

  • theapiarystudios.com

  • kensyu-kan.com

  • dkku88.com

  • tikhyper.com

  • aztecnort.com

  • homebrim.com

Targets

    • Target
      Bdcuhmcgbsvmxhmuasrulqqnfbjdnogomk.exe
    • Size 814KB
    • SHA256 4d80ab79360b092bb5d8fa41d14388dffe5ef42839b6dbbf741f0ce5c3424d1e
    • MD5 SHA1 SHA512
    Score
    10/10
    formbook3nopratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks