Overview

overview

10

Static

static

1

6c57d95418...dd.exe

windows7-x64

10

6c57d95418...dd.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6c57d954185304fcdf601ae96c7683dd.exe
  • Size 312KB
  • Sample221122-lnrl9scd71
  • SHA256 e2175069548a88b8d2eb7f6fd0dcb8760317025817cb6d2c8b40a3ff71972a6f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookh3haratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • h3ha

Decoy

  • ideas-dulces.store

  • store1995.store

  • swuhn.com

  • ninideal.com

  • musiqhaus.com

  • quranchart.com

  • kszq26.club

  • lightfx.online

  • thetickettruth.com

  • meritloancubk.com

  • lawnforcement.com

  • sogeanetwork.com

  • thedinoexotics.com

  • kojima-ah.net

  • gr-myab3z.xyz

  • platiniuminestor.net

  • reviewsiske.com

  • stessil-lifestyle.com

  • goodqjourney.biz

  • cirimpianti.com

Targets

    • Target
      6c57d954185304fcdf601ae96c7683dd.exe
    • Size 312KB
    • SHA256 e2175069548a88b8d2eb7f6fd0dcb8760317025817cb6d2c8b40a3ff71972a6f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookh3haratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks