Overview

overview

10

Static

static

2568935548...06.exe

windows7_x64

10

2568935548...06.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2568935548847088614d36f8ebeee706
  • Size 750KB
  • Sample210930-x272ysaebj
  • SHA256 f136f4f9c59c4ff2582063222c6df106a3d1e3d7d9220ff73e3cb2ec487fe1db
  • MD5 SHA1 SHA512
Score
10/10
formbookhp6sratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • hp6s

C2

  • http://www.binoler.xyz/hp6s/

Decoy

  • rlgbsuilds.com

  • sojikshop.store

  • animastrue.art

  • cameratademurcia.com

  • plxcksd.xyz

  • fuyrew.online

  • seeingmessagenow0541.com

  • swoern.info

  • affordableapartmentssl.com

  • apprendre.study

  • metaju.com

  • xiayang1314.space

  • nftpay.pro

  • digitalimmersioncg.com

  • americanrenegadeclothingco.com

  • housesvaluation.com

  • gotpodia.com

  • allthingsgoddes.com

  • voovno.com

  • nsbeneae.com

Targets

    • Target
      2568935548847088614d36f8ebeee706
    • Size 750KB
    • SHA256 f136f4f9c59c4ff2582063222c6df106a3d1e3d7d9220ff73e3cb2ec487fe1db
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookhp6sratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks