Overview

overview

10

Static

static

2c6f2b4f3c...0f.exe

windows7_x64

10

2c6f2b4f3c...0f.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2c6f2b4f3cf82baa0211f254b07dae0f.exe
  • Size 679KB
  • Sample210907-l6sbhsffap
  • SHA256 c0447d2efa01433e46c26f66e24b9d35fa30c19c13667dc4867c478b71bb95d5
  • MD5 SHA1 SHA512
Score
10/10
formbookif60ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • if60

C2

  • http://www.lanhaiguotou.com/if60/

Decoy

  • dutaaksarawedar.com

  • conflicttech.com

  • growinfant.com

  • desingchiro.com

  • juicykingcrabexpress1111.com

  • christal-capital.com

  • mythicspacex.com

  • eezeecompliance.com

  • smartpro-apps.com

  • foliapaper.com

  • decor-galorec.com

  • wednesdaywinetime.com

  • ecnstore.com

  • icitycompany.com

  • kokaabrows.com

  • edwardmillerplumbing.com

  • nasiratusa.net

  • thaicafeirvine.com

  • serviceinnovation.net

  • freedigilife.com

Targets

    • Target
      2c6f2b4f3cf82baa0211f254b07dae0f.exe
    • Size 679KB
    • SHA256 c0447d2efa01433e46c26f66e24b9d35fa30c19c13667dc4867c478b71bb95d5
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookif60ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks