Overview

overview

10

Static

static

846940a386...0a.exe

windows7_x64

10

846940a386...0a.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    846940a386dd30a0fbc9833e19dd550a.exe
  • Size 524KB
  • Sample220113-tdf2sabce2
  • SHA256 9fae8a9fba8705091a5c09a9d05996f0136d276f2178589948a37253ad27f6e7
  • MD5 SHA1 SHA512
Score
10/10
formbooklw6nratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • lw6n

Decoy

  • spinningthe.com

  • portkatakolo.com

  • koryhoang.com

  • cosmicchocolateshop.com

  • islandlifevsc.com

  • spanisted.com

  • directemploymentcanada.com

  • sarasotanumismatic.com

  • markgroupcompanies.com

  • naiso.ltd

  • slimmedietusa.com

  • online-esta.com

  • girlagainstworld.com

  • reparaciones.info

  • metabolism.group

  • loadingmetaverse.com

  • julias-grafik.com

  • bayonttra.net

  • fffk.club

  • youdeservebeautiful.store

Targets

    • Target
      846940a386dd30a0fbc9833e19dd550a.exe
    • Size 524KB
    • SHA256 9fae8a9fba8705091a5c09a9d05996f0136d276f2178589948a37253ad27f6e7
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooklw6nratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks