Overview

overview

10

Static

static

1fe53e61aa...54.exe

windows7_x64

10

1fe53e61aa...54.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    1fe53e61aa8fcdd22b53a5e733947154
  • Size 462KB
  • Sample211220-qph4qsafd3
  • SHA256 ae371c388cd7f047ae61f852158fc5de2c7f5ab2bdda4b211b9fd87c7b6272dc
  • MD5 SHA1 SHA512
Score
10/10
formbooka83rratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • a83r

Decoy

  • comercializadoralonso.com

  • durhamschoolservces.com

  • onegreencapital.com

  • smartcities24.com

  • maquinas.store

  • brianlovesbonsai.com

  • xin41518s.com

  • moneyearnus.xyz

  • be-mix.com

  • fengyat.club

  • inspectdecided.xyz

  • paksafpakistan.com

  • orhidlnt.top

  • princesuraj.com

  • vietnamvodka.com

  • renewnow.site

  • imageservices.xyz

  • luxurytravelfranchise.com

  • kp112.red

  • royalyorkfirewood.com

Targets

    • Target
      1fe53e61aa8fcdd22b53a5e733947154
    • Size 462KB
    • SHA256 ae371c388cd7f047ae61f852158fc5de2c7f5ab2bdda4b211b9fd87c7b6272dc
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooka83rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks