Overview

overview

10

Static

static

234e96fd91...27.exe

windows7_x64

234e96fd91...27.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    234e96fd91a8c8ba1da7e94609bd6827
  • Size 529KB
  • Sample210804-4dg25zeb2j
  • SHA256 4236f52cf6fd6ea644ed667c05d524e7b60b4ce69767eb89b4c1113701ad5867
  • MD5 SHA1 SHA512
Score
10/10
formbookratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

C2

  • http://www.odysseysailingsantorini.com/cmsr/

Decoy

  • dahlia-dolls.com

  • iamawife.com

  • gardunomx.com

  • roweelitetrucking.com

  • asapvk.com

  • strategieslimited.com

  • healthyweathorganics.com

  • wedding-gallery.net

  • fastoffer.online

  • biolab33.cloud

  • los40delocta.com

  • charliepaton.com

  • jenpaddock.com

  • zzmweb.com

  • poetarts.com

  • techwork4u.com

  • tracylynpropp.com

  • rkbodyfit.site

  • migaleriapanama.com

  • cosmostco.com

Targets

    • Target
      234e96fd91a8c8ba1da7e94609bd6827
    • Size 529KB
    • SHA256 4236f52cf6fd6ea644ed667c05d524e7b60b4ce69767eb89b4c1113701ad5867
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks