Overview

overview

10

Static

static

70a1b0e287...6b.exe

windows7_x64

10

70a1b0e287...6b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70a1b0e287cfb57fdafc401193a4476b

  • Size

    519KB

  • Sample

    211018-pt5ymaeedm

  • MD5

    70a1b0e287cfb57fdafc401193a4476b

  • SHA1

    b552e549510bc446c458b734ebf68c6103abc1e9

  • SHA256

    0dfb17fc59cf0a026c3185341c73ba25d6cb5ef0d886ce8dd00db39c1740c2f1

  • SHA512

    a485fc04e2559c654567605eac8c95b031c8f1a5bfb42be2e0ea1eb44e34faa555702db7d0258c14f12790b5cf2f54ac0a30040c58ccf0978bfee7b96789895a

Score
10/10
formbooks6tnratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s6tn

C2

http://www.majordomus-gliwice.com/s6tn/

Decoy

ya-volna.com

nakimura.online

buildtheyamato.com

carecard.xyz

orthozayn.com

sitd.xyz

garu.club

alfainfocom.com

floridalacrossecamps.com

banytus.xyz

dogodipiskot.quest

ljlsaf.com

shaheenricemills.com

cuevieujni.info

chrisandkcollection.com

sunadokei.website

hoidotsbirky.quest

creditassociatesllc.com

amazonhrjobs.com

the-luggage-dropp-off.com

Targets

    • Target

      70a1b0e287cfb57fdafc401193a4476b

    • Size

      519KB

    • MD5

      70a1b0e287cfb57fdafc401193a4476b

    • SHA1

      b552e549510bc446c458b734ebf68c6103abc1e9

    • SHA256

      0dfb17fc59cf0a026c3185341c73ba25d6cb5ef0d886ce8dd00db39c1740c2f1

    • SHA512

      a485fc04e2559c654567605eac8c95b031c8f1a5bfb42be2e0ea1eb44e34faa555702db7d0258c14f12790b5cf2f54ac0a30040c58ccf0978bfee7b96789895a

    Score
    10/10
    formbooks6tnratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks