Overview

overview

10

Static

static

910e402acb...72.exe

windows7_x64

10

910e402acb...72.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    910e402acb7dd80de2c226dee4884972
  • Size 589KB
  • Sample220615-x4czlabder
  • SHA256 5db721b707413a375c8804a1df44fc36a679bf059679a05d4deb3e99d81880b5
  • MD5 SHA1 SHA512
Score
10/10
formbooknk6lratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • nk6l

Decoy

  • cbnextra.com

  • entitysystemsinc.com

  • 55midwoodave.com

  • ebelizzi.com

  • khojcity.com

  • 1527brokenoakdrive.site

  • housinghproperties.com

  • ratiousa.com

  • lrcrepresentacoes.net

  • tocoec.net

  • khadamatdemnate.com

  • davidkastner.xyz

  • gardeniaresort.com

  • qiantangguoji.com

  • visaprepaidprocessinq.com

  • cristinamadara.com

  • semapisus.xyz

  • mpwebagency.net

  • alibabasdeli.com

  • gigasupplies.com

Targets

    • Target
      910e402acb7dd80de2c226dee4884972
    • Size 589KB
    • SHA256 5db721b707413a375c8804a1df44fc36a679bf059679a05d4deb3e99d81880b5
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooknk6lratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks