Overview

overview

10

Static

static

1

SecuriteIn...26.exe

windows7_x64

10

SecuriteIn...26.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.19106.22726
  • Size 282KB
  • Sample211028-p3gx6agdar
  • SHA256 8a13ce3da212f3557c8d3f43a375fa6e030b400c2da2ca9701bed88f839863fc
  • MD5 SHA1 SHA512
Score
10/10
formbookdyh6ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • dyh6

C2

  • http://www.tttk8.site/dyh6/

Decoy

  • ximmgepn.xyz

  • bonitacandle.com

  • thesneakerhubofficial.com

  • miabags.online

  • maboxhistoire.com

  • viral22.com

  • gracebruno.xyz

  • safetycare.xyz

  • aerith.store

  • mountaingirlbbq.com

  • bhbuildertest-ecom.space

  • klhcn.com

  • guizhouhl.top

  • noreply-engagementboost.com

  • derdmlaucaty.store

  • viffetrade.com

  • iesyttsn.xyz

  • msumon.com

  • autoforos.com

  • carlosmorgan.com

Targets

    • Target
      SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.19106.22726
    • Size 282KB
    • SHA256 8a13ce3da212f3557c8d3f43a375fa6e030b400c2da2ca9701bed88f839863fc
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookdyh6ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks