Overview

overview

10

Static

static

74a7e2df53...f7.exe

windows7_x64

10

74a7e2df53...f7.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    74a7e2df53880519d2bbad6397c8ecf7
  • Size 609KB
  • Sample211118-y3t26aaec2
  • SHA256 862aab1f62349d70f33bdfbcfba008e6ffbf499c6e79e6f701641f478e5e30b2
  • MD5 SHA1 SHA512
Score
10/10
formbookbtn2ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • btn2

C2

  • http://www.premiumhealthyoptions.com/btn2/

Decoy

  • benjaminthompsonphd.com

  • executivetags.info

  • junleh.com

  • itieodhn.xyz

  • agenteajuda.com

  • antibodytechnologies.net

  • 22obrionstreet.com

  • farmavidabr.com

  • crackshotphysics.com

  • teachermeta.com

  • allandalucia.com

  • huidong-cn.com

  • yoyn.xyz

  • etredivin.info

  • moondawgsnashville.com

  • ctybdstaybachill.com

  • immobilier-nicolas.com

  • relativer.xyz

  • entyrcrypto.com

  • paedyt.xyz

Targets

    • Target
      74a7e2df53880519d2bbad6397c8ecf7
    • Size 609KB
    • SHA256 862aab1f62349d70f33bdfbcfba008e6ffbf499c6e79e6f701641f478e5e30b2
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookbtn2ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks