Overview

overview

10

Static

static

dllhost.exe

windows7_x64

10

dllhost.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dllhost.exe

  • Size

    485KB

  • Sample

    211012-mtxk5scbg4

  • MD5

    1fe73fe4d37cae6a02262b5164f3def0

  • SHA1

    80b03eb27651723bded1fd1425f489225b3bba3b

  • SHA256

    0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8

  • SHA512

    7416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6

Score
10/10
formbookkzk9ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

C2

http://www.yourmajordomo.com/kzk9/

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Targets

    • Target

      dllhost.exe

    • Size

      485KB

    • MD5

      1fe73fe4d37cae6a02262b5164f3def0

    • SHA1

      80b03eb27651723bded1fd1425f489225b3bba3b

    • SHA256

      0c33fe39195569a868cf9f87d3aff16e72f5a54c4e52a852b8f986d121fa47e8

    • SHA512

      7416dadb6e85cc43000bba33f47797cf7e5fe5ee0c9f8639685130264a867b6048839d2b74ca3e00b00caf8a1dcf83d08f01901c56ab9343888d62501c48d2b6

    Score
    10/10
    formbookkzk9ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks