Overview

overview

10

Static

static

64fdb0804f...85.exe

windows7_x64

10

64fdb0804f...85.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    64fdb0804feecf1a245950057bc0f785

  • Size

    617KB

  • Sample

    211121-2hnanahdh3

  • MD5

    64fdb0804feecf1a245950057bc0f785

  • SHA1

    6eaffad8954dbedbbde053bf262a4ebf437022e0

  • SHA256

    dad4a79f2e84a90393bc1ad3134c985f46d75468eb4488d4ec692db32bff41ef

  • SHA512

    22ba9be2fa94cad44d69b9e1f603824522b2fcf8941260e9c0084bbde7d8887e8f17ea758eb637d7fdd0d52dbb123c5e854241a0a26b1f91bc8f7c68c4d4adf4

Score
10/10
formbooks18yratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s18y

C2

http://www.agentpathleurre.space/s18y/

Decoy

jokes-online.com

dzzdjn.com

lizzieerhardtebnaryepptts.com

interfacehand.xyz

sale-m.site

block-facebook.com

dicasdamadrinha.com

maythewind.com

hasari.net

omnists.com

thevalley-eg.com

rdfj.xyz

szhfcy.com

alkalineage.club

fdf.xyz

absorplus.com

poldolongo.com

badassshirts.club

ferienwohnungenmv.com

bilboondokoak.com

Targets

    • Target

      64fdb0804feecf1a245950057bc0f785

    • Size

      617KB

    • MD5

      64fdb0804feecf1a245950057bc0f785

    • SHA1

      6eaffad8954dbedbbde053bf262a4ebf437022e0

    • SHA256

      dad4a79f2e84a90393bc1ad3134c985f46d75468eb4488d4ec692db32bff41ef

    • SHA512

      22ba9be2fa94cad44d69b9e1f603824522b2fcf8941260e9c0084bbde7d8887e8f17ea758eb637d7fdd0d52dbb123c5e854241a0a26b1f91bc8f7c68c4d4adf4

    Score
    10/10
    formbooks18yratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks