Overview

overview

10

Static

static

1

3b7ed2c43e...fe.exe

windows7_x64

10

3b7ed2c43e...fe.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3b7ed2c43e608053f737b3a1e82a1cfe
  • Size 291KB
  • Sample211118-mpdx8sfed4
  • SHA256 2f6e89afd122fb052c5ad063bfe784b854157f9ff99af0a8aae4b7d19641ff61
  • MD5 SHA1 SHA512
Score
10/10
formbookdyh6ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • dyh6

C2

  • http://www.tttk8.site/dyh6/

Decoy

  • ximmgepn.xyz

  • bonitacandle.com

  • thesneakerhubofficial.com

  • miabags.online

  • maboxhistoire.com

  • viral22.com

  • gracebruno.xyz

  • safetycare.xyz

  • aerith.store

  • mountaingirlbbq.com

  • bhbuildertest-ecom.space

  • klhcn.com

  • guizhouhl.top

  • noreply-engagementboost.com

  • derdmlaucaty.store

  • viffetrade.com

  • iesyttsn.xyz

  • msumon.com

  • autoforos.com

  • carlosmorgan.com

Targets

    • Target
      3b7ed2c43e608053f737b3a1e82a1cfe
    • Size 291KB
    • SHA256 2f6e89afd122fb052c5ad063bfe784b854157f9ff99af0a8aae4b7d19641ff61
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookdyh6ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks