Overview

overview

10

Static

static

9227463ffb...a7.exe

windows7_x64

10

9227463ffb...a7.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9227463ffb6e37d271919e06d175eda7.exe
  • Size 514KB
  • Sample211027-pg6z6aeff8
  • SHA256 5e529cbb901aced8a6af49250afd3d67e059d717d7ecf3edc32e18a9d549361c
  • MD5 SHA1 SHA512
Score
10/10
formbooks18yratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • s18y

C2

  • http://www.agentpathleurre.space/s18y/

Decoy

  • jokes-online.com

  • dzzdjn.com

  • lizzieerhardtebnaryepptts.com

  • interfacehand.xyz

  • sale-m.site

  • block-facebook.com

  • dicasdamadrinha.com

  • maythewind.com

  • hasari.net

  • omnists.com

  • thevalley-eg.com

  • rdfj.xyz

  • szhfcy.com

  • alkalineage.club

  • fdf.xyz

  • absorplus.com

  • poldolongo.com

  • badassshirts.club

  • ferienwohnungenmv.com

  • bilboondokoak.com

Targets

    • Target
      9227463ffb6e37d271919e06d175eda7.exe
    • Size 514KB
    • SHA256 5e529cbb901aced8a6af49250afd3d67e059d717d7ecf3edc32e18a9d549361c
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooks18yratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks