Overview

overview

10

Static

static

4003903fd0...e5.exe

windows7_x64

10

4003903fd0...e5.exe

windows10-2004_x64

4

Sharing

Copy URL Twitter E-mail

General

  • Target
    4003903fd0e1cf7141ee3eb3819499755aeebb0532531524b788135f08e5cbe5
  • Size 532KB
  • Sample220205-t2fqxsdcd9
  • SHA256 4003903fd0e1cf7141ee3eb3819499755aeebb0532531524b788135f08e5cbe5
  • MD5 SHA1 SHA512
Score
10/10
formbookdw5ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 3.9

Campaign

  • dw5

Decoy

  • rincondeguyabitos.com

  • huawei.services

  • atria-securities.com

  • illect-mail.com

  • cerberus.digital

  • benefitsnursingvip.win

  • jimmywilliamsmusic1990.com

  • peabodyathleticclub.com

  • supporetuythub.online

  • supportf.net

  • arthurlazaryan.com

  • royalsparkfacility.com

  • wgshd.com

  • hzb-design.net

  • games-max.com

  • heatfreecurls.com

  • cryptocoinax.com

  • exoawk.com

  • gabbyoz.com

  • andibearing.com

Targets

    • Target
      4003903fd0e1cf7141ee3eb3819499755aeebb0532531524b788135f08e5cbe5
    • Size 532KB
    • SHA256 4003903fd0e1cf7141ee3eb3819499755aeebb0532531524b788135f08e5cbe5
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookdw5ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks