Overview

overview

10

Static

static

1509ce519f...6c.exe

windows7_x64

10

1509ce519f...6c.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    1509ce519f838ca8d053e26a7a1b396c
  • Size 1.6MB
  • Sample201117-qlgab7zyps
  • SHA256 8e9bc8937b7c4448c8302e1e2b03af0e9fac285df0d8615e01e0e383694178b1
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

C2

  • http://www.outtheframecustoms.com/9t6k/

Decoy

  • parklineemployerperks.com

  • container-hq.com

  • harzproductions.com

  • wweebtedge.com

  • sandiegosalesandleasing.com

  • ri-web-dev.com

  • ufomars.com

  • countrybarndogkennel.com

  • imakestuff.xyz

  • lnmqjy.com

  • martialarttemple.com

  • jermaine-williams.com

  • ahomedokita.com

  • buttsliders.com

  • 3344cq.com

  • umkxmhopi.icu

  • houstonlasertreatment.com

  • makingdoathome.com

  • ladysativamarketing.com

  • shroomgiant.com

Targets

    • Target
      1509ce519f838ca8d053e26a7a1b396c
    • Size 1.6MB
    • SHA256 8e9bc8937b7c4448c8302e1e2b03af0e9fac285df0d8615e01e0e383694178b1
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks