Overview

overview

10

Static

static

b87f81920e...91.exe

windows7_x64

10

b87f81920e...91.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b87f81920e06301937deb513ff65bf91.exe
  • Size 403KB
  • Sample211030-hjns2aefa2
  • SHA256 8aa346b87c8d3d53fb5265cd0c04bbd3c8c978b7e1eb7b2e0958c078322d75e9
  • MD5 SHA1 SHA512
Score
10/10
formbooks18yratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • s18y

C2

  • http://www.agentpathleurre.space/s18y/

Decoy

  • jokes-online.com

  • dzzdjn.com

  • lizzieerhardtebnaryepptts.com

  • interfacehand.xyz

  • sale-m.site

  • block-facebook.com

  • dicasdamadrinha.com

  • maythewind.com

  • hasari.net

  • omnists.com

  • thevalley-eg.com

  • rdfj.xyz

  • szhfcy.com

  • alkalineage.club

  • fdf.xyz

  • absorplus.com

  • poldolongo.com

  • badassshirts.club

  • ferienwohnungenmv.com

  • bilboondokoak.com

Targets

    • Target
      b87f81920e06301937deb513ff65bf91.exe
    • Size 403KB
    • SHA256 8aa346b87c8d3d53fb5265cd0c04bbd3c8c978b7e1eb7b2e0958c078322d75e9
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooks18yratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks