Overview

overview

10

Static

static

111d0ceb03...0c.exe

windows7_x64

10

111d0ceb03...0c.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    111d0ceb032b6ce3fbaba134d000ab0c
  • Size 366KB
  • Sample211223-kfvtaahda5
  • SHA256 9029cb23c3237afc1e63076ffba6a89ed9d4fec8df9606feebe68b2de092fa36
  • MD5 SHA1 SHA512
Score
10/10
formbookd2z8ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • d2z8

Decoy

  • jameshenrycfa.com

  • hearing-siemens.com

  • way2noteshub.com

  • metaswapdex.com

  • car-electronic-performance.com

  • aspurgentcare.com

  • htedbchd.website

  • lojakaton.online

  • trukorera.online

  • sevenstoners.com

  • herlihygaragedoors.com

  • starforspotify.com

  • catilaf.com

  • iagroupsocial.com

  • ranchrealestatetx.com

  • wu7btbn1zv9y.xyz

  • realvrz.com

  • needljlane.xyz

  • newsreaderdynamo.com

  • nasser-group.com

Targets

    • Target
      111d0ceb032b6ce3fbaba134d000ab0c
    • Size 366KB
    • SHA256 9029cb23c3237afc1e63076ffba6a89ed9d4fec8df9606feebe68b2de092fa36
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookd2z8ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks