Overview

overview

10

Static

static

3f173af48a...44.exe

windows7_x64

10

3f173af48a...44.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3f173af48a4d20fcd9b276282b597544.exe
  • Size 728KB
  • Sample211122-qxefhsaeh7
  • SHA256 241582074a493ed1b28fa87dcab270e4057eac6fbe0171e14dce9f99c601f2b3
  • MD5 SHA1 SHA512
Score
10/10
formbookbtn2ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • btn2

C2

  • http://www.premiumhealthyoptions.com/btn2/

Decoy

  • benjaminthompsonphd.com

  • executivetags.info

  • junleh.com

  • itieodhn.xyz

  • agenteajuda.com

  • antibodytechnologies.net

  • 22obrionstreet.com

  • farmavidabr.com

  • crackshotphysics.com

  • teachermeta.com

  • allandalucia.com

  • huidong-cn.com

  • yoyn.xyz

  • etredivin.info

  • moondawgsnashville.com

  • ctybdstaybachill.com

  • immobilier-nicolas.com

  • relativer.xyz

  • entyrcrypto.com

  • paedyt.xyz

Targets

    • Target
      3f173af48a4d20fcd9b276282b597544.exe
    • Size 728KB
    • SHA256 241582074a493ed1b28fa87dcab270e4057eac6fbe0171e14dce9f99c601f2b3
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookbtn2ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks