Overview

overview

10

Static

static

5951b00de1...d3.exe

windows7_x64

10

5951b00de1...d3.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5951b00de1dbba519c0bbef33494ced3
  • Size 598KB
  • Sample211111-xfsedahafj
  • SHA256 cf8ab312ec2e263777fd777cdc2f714c18d259241bfeec9dbe6eb4ac62708f7f
  • MD5 SHA1 SHA512
Score
10/10
formbookad6nratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ad6n

C2

  • http://www.didimthebestkuafor.com/ad6n/

Decoy

  • silzqmz.xyz

  • westwardcraftcompany.com

  • roomandroofrealtors.com

  • yellayellayella.com

  • cichoice.com

  • xxtjzmzzahg.com

  • getmavin.com

  • homestylewood.com

  • vlab.group

  • klaesi.net

  • casainbox.com

  • hbjj2a.com

  • viettelbinhduongsieutoc4.online

  • itftravelcoach.com

  • 6fapp142.com

  • before-hage.com

  • onbiine.sbs

  • lyhdyhc.com

  • matt-nagy.com

  • ipwertoe.xyz

Targets

    • Target
      5951b00de1dbba519c0bbef33494ced3
    • Size 598KB
    • SHA256 cf8ab312ec2e263777fd777cdc2f714c18d259241bfeec9dbe6eb4ac62708f7f
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookad6nratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks