Overview

overview

10

Static

static

dafce59283...7c.exe

windows7_x64

10

dafce59283...7c.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    dafce59283b215958f71191b6ec0fc7c.exe
  • Size 782KB
  • Sample211117-s1ea2aabdj
  • SHA256 754a9c7607d3b754e5adab5f2a54a78d7596d2f73096bf4d529012e705cb1230
  • MD5 SHA1 SHA512
Score
10/10
formbookob7yratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ob7y

C2

  • http://www.metanewsroom.net/ob7y/

Decoy

  • ipsdjf.com

  • mlphntec.com

  • restaurant-day.store

  • writeramylong.com

  • flokigamefi.com

  • usetianyi.xyz

  • punishstrikebreaker.quest

  • ericnfleming.com

  • dhhwtieen.xyz

  • milfhackers.com

  • fewefie.store

  • pithstsdiet.store

  • kirsten-hemmerich.com

  • casinolopoca.com

  • sigag.xyz

  • geilepoes.com

  • metawhatsapp.art

  • sarjin.xyz

  • toprabatte.net

  • lotofbrave.club

Targets

    • Target
      dafce59283b215958f71191b6ec0fc7c.exe
    • Size 782KB
    • SHA256 754a9c7607d3b754e5adab5f2a54a78d7596d2f73096bf4d529012e705cb1230
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookob7yratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks