Overview

overview

10

Static

static

5a5121a004...a6.exe

windows7_x64

10

5a5121a004...a6.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5a5121a0040f1f9492b661b709ce42a6.exe
  • Size 1.3MB
  • Sample211214-vbnvaagbc3
  • SHA256 58d05ac8e9716f4322f5d39d676a3415c7f499e99c8fa5d920bbbecdb4a616b7
  • MD5 SHA1 SHA512
Score
10/10
formbookc3f6ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • c3f6

C2

  • http://www.www-supportfindmy.com/c3f6/

Decoy

  • blocksswap.com

  • handywomanpr.com

  • zonderstore.com

  • mertradingbv.com

  • rounuatedanximum.com

  • atozfinance.store

  • pokercoaching.pro

  • spypackz9.com

  • emonk.xyz

  • brendayesteban.com

  • monster-area.com

  • choosetruewellness.com

  • outletint.xyz

  • kurashiki-menkyo.com

  • tooktamilnadu.com

  • wxt08.xyz

  • lojascomprasonline.com

  • suufj.xyz

  • louisebrimble.com

  • jodkmans.com

Targets

    • Target
      5a5121a0040f1f9492b661b709ce42a6.exe
    • Size 1.3MB
    • SHA256 58d05ac8e9716f4322f5d39d676a3415c7f499e99c8fa5d920bbbecdb4a616b7
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookc3f6ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks