Overview

overview

10

Static

static

7244d490d3...5c.exe

windows7_x64

10

7244d490d3...5c.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    7244d490d3bf1bafa56b539dccf6f75c.exe
  • Size 466KB
  • Sample211103-y15e4scadr
  • SHA256 f80f85e18cf0debe8a88bd545a1be3450175ec390fd14b38658e89503f3eca0f
  • MD5 SHA1 SHA512
Score
10/10
formbookad6nratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ad6n

C2

  • http://www.didimthebestkuafor.com/ad6n/

Decoy

  • silzqmz.xyz

  • westwardcraftcompany.com

  • roomandroofrealtors.com

  • yellayellayella.com

  • cichoice.com

  • xxtjzmzzahg.com

  • getmavin.com

  • homestylewood.com

  • vlab.group

  • klaesi.net

  • casainbox.com

  • hbjj2a.com

  • viettelbinhduongsieutoc4.online

  • itftravelcoach.com

  • 6fapp142.com

  • before-hage.com

  • onbiine.sbs

  • lyhdyhc.com

  • matt-nagy.com

  • ipwertoe.xyz

Targets

    • Target
      7244d490d3bf1bafa56b539dccf6f75c.exe
    • Size 466KB
    • SHA256 f80f85e18cf0debe8a88bd545a1be3450175ec390fd14b38658e89503f3eca0f
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookad6nratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks