Overview

overview

10

Static

static

897cd255db...c3.exe

windows7_x64

10

897cd255db...c3.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    897cd255db770c4a0e0ef4b5e01e65c3.exe
  • Size 724KB
  • Sample211122-qy4f2affap
  • SHA256 4253f88eb5e931720c16e56f49babfbf8db93eaa8b6f85146cc2d690aee2b9d2
  • MD5 SHA1 SHA512
Score
10/10
formbookcy88ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • cy88

C2

  • http://www.jamesobrien.school/cy88/

Decoy

  • kj4senate.com

  • emaratishayclub.com

  • digitalpathologytodayuk.com

  • solofirepits.com

  • electronicsflare.com

  • antlersinternational.biz

  • aspirastic.com

  • aqrd.top

  • riversidebest.com

  • jointly.men

  • hostelstyle.com

  • lineupfacts.com

  • shibawire.com

  • africhips.com

  • zbyrhb.com

  • safelywininfo.online

  • antidesign.xyz

  • miramar.press

  • truthaboutjointhealth.com

  • chinadaen.com

Targets

    • Target
      897cd255db770c4a0e0ef4b5e01e65c3.exe
    • Size 724KB
    • SHA256 4253f88eb5e931720c16e56f49babfbf8db93eaa8b6f85146cc2d690aee2b9d2
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookcy88ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks