Overview

overview

10

Static

static

1

619d2ba58e...55.exe

windows7_x64

10

619d2ba58e...55.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    619d2ba58ece0c805f96956f511f5155
  • Size 335KB
  • Sample211223-m85kashfc8
  • SHA256 4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446
  • MD5 SHA1 SHA512
Score
10/10
formbookh4d0ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • h4d0

Decoy

  • onlinefinejewelry.com

  • samstringermusic.com

  • beam-lettings.info

  • optimumcoin.xyz

  • fasa.xyz

  • creativedime.com

  • eihncuz.online

  • griffin2008.top

  • europcarlive.com

  • jxhcar.com

  • museumsshop.international

  • bonolaboral-lnterbank.com

  • kelebandis.xyz

  • hiddenlakeranch.net

  • carelessyouth.com

  • jfkilfoil.store

  • potok-it-ua.site

  • magdulemediation.com

  • shakadal.xyz

  • coastconstructionfl.com

Targets

    • Target
      619d2ba58ece0c805f96956f511f5155
    • Size 335KB
    • SHA256 4fd44b1855341a3f6f31e08e4ad288747ecb8e5b8637b95fff99aa689de07446
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookh4d0ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks