Overview

overview

10

Static

static

0966d63020...30.exe

windows7_x64

10

0966d63020...30.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0966d630209f540a762608f268488530.exe
  • Size 411KB
  • Sample220112-m3z3macdfm
  • SHA256 dfa0138818e4f998337af94d5fea30fc920237ffba320fe5acd7af469db0c4a8
  • MD5 SHA1 SHA512
Score
10/10
formbookd2z8ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • d2z8

Decoy

  • jameshenrycfa.com

  • hearing-siemens.com

  • way2noteshub.com

  • metaswapdex.com

  • car-electronic-performance.com

  • aspurgentcare.com

  • htedbchd.website

  • lojakaton.online

  • trukorera.online

  • sevenstoners.com

  • herlihygaragedoors.com

  • starforspotify.com

  • catilaf.com

  • iagroupsocial.com

  • ranchrealestatetx.com

  • wu7btbn1zv9y.xyz

  • realvrz.com

  • needljlane.xyz

  • newsreaderdynamo.com

  • nasser-group.com

Targets

    • Target
      0966d630209f540a762608f268488530.exe
    • Size 411KB
    • SHA256 dfa0138818e4f998337af94d5fea30fc920237ffba320fe5acd7af469db0c4a8
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookd2z8ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks