Overview

overview

10

Static

static

2465c00645...7e.exe

windows7_x64

10

2465c00645...7e.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2465c0064588369df56b47c28e38aa7e
  • Size 509KB
  • Sample210928-gcar6aafgp
  • SHA256 67cb5ce28fc7e9a5dae6c7be6da453844762fdea43d985cfc761c1ded66487f0
  • MD5 SHA1 SHA512
Score
10/10
formbookhp6sratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • hp6s

C2

  • http://www.binoler.xyz/hp6s/

Decoy

  • rlgbsuilds.com

  • sojikshop.store

  • animastrue.art

  • cameratademurcia.com

  • plxcksd.xyz

  • fuyrew.online

  • seeingmessagenow0541.com

  • swoern.info

  • affordableapartmentssl.com

  • apprendre.study

  • metaju.com

  • xiayang1314.space

  • nftpay.pro

  • digitalimmersioncg.com

  • americanrenegadeclothingco.com

  • housesvaluation.com

  • gotpodia.com

  • allthingsgoddes.com

  • voovno.com

  • nsbeneae.com

Targets

    • Target
      2465c0064588369df56b47c28e38aa7e
    • Size 509KB
    • SHA256 67cb5ce28fc7e9a5dae6c7be6da453844762fdea43d985cfc761c1ded66487f0
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookhp6sratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks