Overview

overview

10

Static

static

3

EKSTRE 06.08.exe

windows7-x64

10

EKSTRE 06.08.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    EKSTRE 06.08.exe
  • Size 253KB
  • Sample230609-hcw6tsbb48
  • SHA256 ae617e932d45d1288f1ef5ecd2b72b2da822d8167142d041b08f61defb59daf3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooka04yratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • a04y

Decoy

  • eclecticconsignment.com

  • ablcommunity.com

  • fcepankshin.africa

  • cootefamily.net

  • chartx.xyz

  • 64422.vip

  • cultured.one

  • breathingsunderrated.com

  • l0w2s.bond

  • atroitskiy.ru

  • caseidxosamazon.com

  • efefthirsty.buzz

  • 0to9shop.com

  • fashion-clothing-40094.com

  • accesactes.com

  • acurreri.com

  • r4wcraft.net

  • benwuyts.com

  • bennettstack.net

  • abetbison.online

Targets

    • Target
      EKSTRE 06.08.exe
    • Size 253KB
    • SHA256 ae617e932d45d1288f1ef5ecd2b72b2da822d8167142d041b08f61defb59daf3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooka04yratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks