Overview

overview

10

Static

static

1

e1744ffeae...61.exe

windows7_x64

10

e1744ffeae...61.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    e1744ffeaede1509ce5eb48e8cb08361
  • Size 309KB
  • Sample211109-p73enacdaq
  • SHA256 415d8e7a309e0e7ea9cec8bd06f9170b0dc15aca3a553ff6fa7f6726997800a3
  • MD5 SHA1 SHA512
Score
10/10
formbookdyh6ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • dyh6

C2

  • http://www.tttk8.site/dyh6/

Decoy

  • ximmgepn.xyz

  • bonitacandle.com

  • thesneakerhubofficial.com

  • miabags.online

  • maboxhistoire.com

  • viral22.com

  • gracebruno.xyz

  • safetycare.xyz

  • aerith.store

  • mountaingirlbbq.com

  • bhbuildertest-ecom.space

  • klhcn.com

  • guizhouhl.top

  • noreply-engagementboost.com

  • derdmlaucaty.store

  • viffetrade.com

  • iesyttsn.xyz

  • msumon.com

  • autoforos.com

  • carlosmorgan.com

Targets

    • Target
      e1744ffeaede1509ce5eb48e8cb08361
    • Size 309KB
    • SHA256 415d8e7a309e0e7ea9cec8bd06f9170b0dc15aca3a553ff6fa7f6726997800a3
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookdyh6ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks