Overview

overview

10

Static

static

86eff80319...fb.exe

windows7_x64

10

86eff80319...fb.exe

windows10-2004_x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target
    86eff8031914e78fa8fc265d40b014fb
  • Size 389KB
  • Sample220118-v925kaccd5
  • SHA256 af0fecfaa578184482893c6a88aea692e9a2dd8dddba0a51fb08ce81ff01e13c
  • MD5 SHA1 SHA512
Score
10/10
formbookn0k1ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • n0k1

Decoy

  • tyupa.xyz

  • scion.xyz

  • smjacob.com

  • intelligentsiaunionyes.com

  • myartismytemple.com

  • roethlisburgers.com

  • burny-live-bar.com

  • amricanfamilyinsurance.com

  • barossavalleycollective.online

  • coinstarrevenue.com

  • ionablissfullife.com

  • worryfreeads.com

  • 9xu5qkr1.xyz

  • julbera.xyz

  • denko-puro.com

  • boardsavorybeambark.club

  • coronarules.info

  • hailiangyinqing.com

  • pageonandroid.tech

  • 1meqtaw8.xyz

Targets

    • Target
      86eff8031914e78fa8fc265d40b014fb
    • Size 389KB
    • SHA256 af0fecfaa578184482893c6a88aea692e9a2dd8dddba0a51fb08ce81ff01e13c
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookn0k1ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks