Overview

overview

10

Static

static

632300e748...d4.exe

windows7_x64

10

632300e748...d4.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    632300e7486ea3fb4085ebd8df35b0d4
  • Size 845KB
  • Sample211117-s9xtqsdcb7
  • SHA256 3335218b7e280d81eb75ec3e4b124d9ad985f3849b508a8b9b4fb359f5dfbbfb
  • MD5 SHA1 SHA512
Score
10/10
formbookfl9wratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • fl9w

C2

  • http://www.makheads.com/fl9w/

Decoy

  • alicebowtique.com

  • way2discounts.com

  • chihangjingmi.com

  • exmcap.com

  • artisquid.com

  • financelbs.com

  • tresholdnetwork.com

  • www-9367.com

  • funtripsouthindia.com

  • ibew-neca.com

  • elqaunim.com

  • gbetapi.com

  • turkthee.com

  • greaterdetroitrealtyexpert.com

  • springhousevet.com

  • dgjt1688.com

  • broomsweeping.com

  • bettyfred.xyz

  • afmcabnot6.xyz

  • toylandmetaverse.com

Targets

    • Target
      632300e7486ea3fb4085ebd8df35b0d4
    • Size 845KB
    • SHA256 3335218b7e280d81eb75ec3e4b124d9ad985f3849b508a8b9b4fb359f5dfbbfb
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookfl9wratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks