Overview

overview

10

Static

static

494712fb90...ae.exe

windows7_x64

10

494712fb90...ae.exe

windows10-2004_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    494712fb9005602f605a433acc37d8ae
  • Size 530KB
  • Sample220203-s6hweabdbm
  • SHA256 0e8333bd57ef2ac051d65249e88b4fbc2e648951e5e417cc807bb9e23edffab1
  • MD5 SHA1 SHA512
Score
10/10
formbookbt33ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • bt33

Decoy

  • mbaonlinefreedegress.info

  • myforevermaid.com

  • daoyi365.com

  • weientm.com

  • legal-mx.com

  • formationrigging.com

  • heidiet.xyz

  • school-prosto.store

  • healthvitaminnutrition.com

  • digitalsolutionusa.com

  • little-bazar.com

  • jnbeautycanada.com

  • optoelek.com

  • learntoairmail.com

  • hawkminer.com

  • kingofearth.love

  • ktnstay.xyz

  • zouxin.love

  • mainlandpr.com

  • mamm-hummel.com

Targets

    • Target
      494712fb9005602f605a433acc37d8ae
    • Size 530KB
    • SHA256 0e8333bd57ef2ac051d65249e88b4fbc2e648951e5e417cc807bb9e23edffab1
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookbt33ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks