Overview

overview

10

Static

static

3741dbf3b2...15.exe

windows7_x64

10

3741dbf3b2...15.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3741dbf3b24224ab2afa902d5aacac15.exe
  • Size 650KB
  • Sample220104-tryhzshfak
  • SHA256 f0427effe53373b51d8b98f19d87a1e39cbcc49201d307526b5ced3406fed4e0
  • MD5 SHA1 SHA512
Score
10/10
formbookmh43ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • mh43

Decoy

  • vhidgaming.com

  • wwwhighmarkgivesthanks.com

  • mucapo.xyz

  • lososossoftball.com

  • southfltitles.com

  • zar-renovations.com

  • armahntrading.com

  • bestnewsoftheday.com

  • kidsnotguns.com

  • gpstephan.com

  • ajaz.xyz

  • metaverserentalsnow.com

  • jacksonholepropertygroup.com

  • dontusetestworkspace2.com

  • fhirblocks.net

  • 101week.com

  • holding-af.com

  • blacksnakemodifications.com

  • opusfile.xyz

  • universalprosperitynetwork.com

Targets

    • Target
      3741dbf3b24224ab2afa902d5aacac15.exe
    • Size 650KB
    • SHA256 f0427effe53373b51d8b98f19d87a1e39cbcc49201d307526b5ced3406fed4e0
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookmh43ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks