Overview

overview

10

Static

static

7731f93c1a...36.exe

windows7_x64

10

7731f93c1a...36.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    7731f93c1a2dd332bb7f511ced1ce236.exe
  • Size 838KB
  • Sample220125-np65fsfdc8
  • SHA256 5fabf5c9fcceb520d7023eaf53122959f42bdb4b1c82bc916baa4bbb94f787ae
  • MD5 SHA1 SHA512
Score
10/10
formbookfezuratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • fezu

Decoy

  • palisadeshiking.com

  • lusteror.com

  • blogmisaficiones.com

  • firstprinciplesteam.com

  • theindoorfarmer.info

  • sddn55.xyz

  • womensclothingonlineshop.com

  • amourneim.com

  • getlumichargeserver.com

  • mynegociodev.com

  • xn--riq159j.com

  • the-social-hub.com

  • buypremiumvpn.xyz

  • brightnes.info

  • catmanshopper.com

  • michellepalacdesigns.com

  • moveventurecapital.com

  • nzhzygba.com

  • papahungry.com

  • electric-classic-bike.com

Targets

    • Target
      7731f93c1a2dd332bb7f511ced1ce236.exe
    • Size 838KB
    • SHA256 5fabf5c9fcceb520d7023eaf53122959f42bdb4b1c82bc916baa4bbb94f787ae
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookfezuratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks