Overview

overview

10

Static

static

046b1bc419...6a.exe

windows7_x64

10

046b1bc419...6a.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    046b1bc419c9849276e2c147de77076a.exe
  • Size 1002KB
  • Sample211207-py3dascaf7
  • SHA256 734bf6dc37410e78255fb46135d5914666b39f17124efcfbc20fb005c54c75ee
  • MD5 SHA1 SHA512
Score
10/10
formbookay09ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ay09

C2

  • http://www.zanillar.com/ay09/

Decoy

  • mhbrandsgroup.com

  • alucontainer.xyz

  • lining0516.xyz

  • kupyty-vynnytsia.online

  • bandjes-smartwatch.online

  • rotlrco.xyz

  • canarybuilder.com

  • de-de.wiki

  • bmtlabs.xyz

  • waxrip.online

  • tuinguhanhphuc.com

  • duelpics.com

  • threegforfree.com

  • trickzda.space

  • placementads.site

  • auto-66.store

  • meckelrealty.com

  • official.solar

  • funnyflights.com

  • hotdfb.com

Targets

    • Target
      046b1bc419c9849276e2c147de77076a.exe
    • Size 1002KB
    • SHA256 734bf6dc37410e78255fb46135d5914666b39f17124efcfbc20fb005c54c75ee
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookay09ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks