Overview

overview

10

Static

static

077d601ae8...73.exe

windows7_x64

10

077d601ae8...73.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    077d601ae84a0f88f6c1671772908f73.exe
  • Size 443KB
  • Sample210924-kpcztsgddj
  • SHA256 49d82a6b19fe35893b419696bace48db225826ccfa73da61ca22f59f7f045406
  • MD5 SHA1 SHA512
Score
10/10
formbookif60ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • if60

C2

  • http://www.handelsbetriebposavec.com/if60/

Decoy

  • babyjames.space

  • dtjug.com

  • bhagteri.com

  • havplan.com

  • gentlesuccess.net

  • negativeminus.com

  • utesm.com

  • ngomen.online

  • abohemianeducation.com

  • hyper-quote.com

  • poseidonflooring.com

  • theshopdental.com

  • consumelocaloficial.com

  • tineue.com

  • traerpolio.com

  • somnambulantfarms.com

  • sugarhillclassiccars.com

  • brasseriedufayard.com

  • replacerglass.net

  • lazyguysmarketing.com

Targets

    • Target
      077d601ae84a0f88f6c1671772908f73.exe
    • Size 443KB
    • SHA256 49d82a6b19fe35893b419696bace48db225826ccfa73da61ca22f59f7f045406
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookif60ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks