Overview

overview

10

Static

static

bba71bbf35...66.exe

windows7_x64

10

bba71bbf35...66.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    bba71bbf358b7f7b1f40f55246343c66
  • Size 617KB
  • Sample211118-3jalmabcc6
  • SHA256 2f013b6c0a13830f5fb60d799623ce6131f6b37ff9b47b8de35f2daa9631feee
  • MD5 SHA1 SHA512
Score
10/10
formbookad6nratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ad6n

C2

  • http://www.didimthebestkuafor.com/ad6n/

Decoy

  • silzqmz.xyz

  • westwardcraftcompany.com

  • roomandroofrealtors.com

  • yellayellayella.com

  • cichoice.com

  • xxtjzmzzahg.com

  • getmavin.com

  • homestylewood.com

  • vlab.group

  • klaesi.net

  • casainbox.com

  • hbjj2a.com

  • viettelbinhduongsieutoc4.online

  • itftravelcoach.com

  • 6fapp142.com

  • before-hage.com

  • onbiine.sbs

  • lyhdyhc.com

  • matt-nagy.com

  • ipwertoe.xyz

Targets

    • Target
      bba71bbf358b7f7b1f40f55246343c66
    • Size 617KB
    • SHA256 2f013b6c0a13830f5fb60d799623ce6131f6b37ff9b47b8de35f2daa9631feee
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookad6nratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks