Overview

overview

10

Static

static

9742c05bbe...33.exe

windows7_x64

10

9742c05bbe...33.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9742c05bbed2b1084b81fabd51a2af33
  • Size 637KB
  • Sample211009-jptrxafah7
  • SHA256 5be742e9644f86ef1d407e5b3e85dff6211561e6dbf9c9fc85b0c5289b899979
  • MD5 SHA1 SHA512
Score
10/10
formbookbcktratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • bckt

C2

  • http://www.picnictablecompany.com/bckt/

Decoy

  • termoindustrias.com

  • vcjcfw.com

  • digitalmoutain.com

  • outtanowhereentertainment.com

  • kcreative.design

  • tea-mails.com

  • xn--ob0b23la.com

  • lanyard-for-keys.com

  • luoyuanqiong.com

  • goxhome.com

  • spryandhonner.com

  • sheltrd.com

  • aagamdahale.com

  • charlie-fendius.com

  • zekesky.com

  • bills360hub.com

  • byrsmith.com

  • emaxpk.com

  • waterproofselection.com

  • primelab.xyz

Targets

    • Target
      9742c05bbed2b1084b81fabd51a2af33
    • Size 637KB
    • SHA256 5be742e9644f86ef1d407e5b3e85dff6211561e6dbf9c9fc85b0c5289b899979
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookbcktratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks