Overview

overview

10

Static

static

e9948eccd8...ca.exe

windows7_x64

10

e9948eccd8...ca.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    e9948eccd83e0ad940ba95b465b8d8ca
  • Size 720KB
  • Sample211122-rrae2sffhr
  • SHA256 ecc6439ff97e4b77f3af320e4c224f712478610fd28a1b6e6a03573c4b90f405
  • MD5 SHA1 SHA512
Score
10/10
formbooka34bratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • a34b

C2

  • http://www.hdetpnipa.xyz/a34b/

Decoy

  • mesonarte.com

  • eksiwakun9.xyz

  • dustcollectionconsultant.com

  • heliosarchitecture.com

  • chinaanalysisgroup.com

  • nimbinhillshemp.com

  • ychain.biz

  • mountshastaart.com

  • monstermangoloco.com

  • bodhiandbear.com

  • rootednft.xyz

  • metayema.com

  • zw21.xyz

  • criccketworld.com

  • segurobarato.net

  • ananyacap.com

  • momo-momo.xyz

  • ezrealestatedeals.com

  • ghrde.xyz

  • idimol.com

Targets

    • Target
      e9948eccd83e0ad940ba95b465b8d8ca
    • Size 720KB
    • SHA256 ecc6439ff97e4b77f3af320e4c224f712478610fd28a1b6e6a03573c4b90f405
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooka34bratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks