Overview

overview

10

Static

static

b70e73fe63...67.exe

windows7_x64

10

b70e73fe63...67.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b70e73fe6384e4562314919e98a4b767
  • Size 476KB
  • Sample211129-vvt6eafec9
  • SHA256 534bf82b9bfdae2bd4afd8a8441237b69d926a5bf4d250f076b47b1377305f8f
  • MD5 SHA1 SHA512
Score
10/10
formbooknk6lratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • nk6l

C2

  • http://www.rthearts.com/nk6l/

Decoy

  • cbnextra.com

  • entitysystemsinc.com

  • 55midwoodave.com

  • ebelizzi.com

  • khojcity.com

  • 1527brokenoakdrive.site

  • housinghproperties.com

  • ratiousa.com

  • lrcrepresentacoes.net

  • tocoec.net

  • khadamatdemnate.com

  • davidkastner.xyz

  • gardeniaresort.com

  • qiantangguoji.com

  • visaprepaidprocessinq.com

  • cristinamadara.com

  • semapisus.xyz

  • mpwebagency.net

  • alibabasdeli.com

  • gigasupplies.com

Targets

    • Target
      b70e73fe6384e4562314919e98a4b767
    • Size 476KB
    • SHA256 534bf82b9bfdae2bd4afd8a8441237b69d926a5bf4d250f076b47b1377305f8f
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooknk6lratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks