Overview

overview

10

Static

static

5b42a7b31f...3c.exe

windows7_x64

10

5b42a7b31f...3c.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5b42a7b31fc2f287f8068cc4c574e93c
  • Size 399KB
  • Sample211119-jttygacfg4
  • SHA256 0c192374ba684e25b4e86887d8ed5168f0c01d606a666e24191f6416aca9123a
  • MD5 SHA1 SHA512
Score
10/10
formbookfl9wratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • fl9w

C2

  • http://www.makheads.com/fl9w/

Decoy

  • alicebowtique.com

  • way2discounts.com

  • chihangjingmi.com

  • exmcap.com

  • artisquid.com

  • financelbs.com

  • tresholdnetwork.com

  • www-9367.com

  • funtripsouthindia.com

  • ibew-neca.com

  • elqaunim.com

  • gbetapi.com

  • turkthee.com

  • greaterdetroitrealtyexpert.com

  • springhousevet.com

  • dgjt1688.com

  • broomsweeping.com

  • bettyfred.xyz

  • afmcabnot6.xyz

  • toylandmetaverse.com

Targets

    • Target
      5b42a7b31fc2f287f8068cc4c574e93c
    • Size 399KB
    • SHA256 0c192374ba684e25b4e86887d8ed5168f0c01d606a666e24191f6416aca9123a
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookfl9wratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks