Overview

overview

10

Static

static

ab00b875e9...4a.exe

windows7_x64

10

ab00b875e9...4a.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ab00b875e9d7ec4065d7dbbda08d474a
  • Size 510KB
  • Sample211111-vejpqsbfh9
  • SHA256 0789b4aec138cf9c5bc3b01774fc8ed075dadf40c8ecf97058c201c9de22160e
  • MD5 SHA1 SHA512
Score
10/10
formbooke6b3ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • e6b3

C2

  • http://www.xn--7tq168cfwa.xn--6qq986b3xl/e6b3/

Decoy

  • kojiphotography.press

  • segunadebayoestates.com

  • app330.com

  • drivenwaxshop.com

  • bocatasystem.com

  • lagalamasin.com

  • vsajobs.net

  • logos-performance.com

  • leadershuttle.net

  • kubanitka.com

  • teamosu.club

  • w0lgzcir2.com

  • cornwall-surf.com

  • melokuq.xyz

  • angelob.xyz

  • gnomelf.com

  • whale-capture19700823.space

  • highclear.xyz

  • hwadamgallery.com

  • teayes2014.com

Targets

    • Target
      ab00b875e9d7ec4065d7dbbda08d474a
    • Size 510KB
    • SHA256 0789b4aec138cf9c5bc3b01774fc8ed075dadf40c8ecf97058c201c9de22160e
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooke6b3ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks