Overview

overview

10

Static

static

47fcea2010...31.exe

windows7_x64

1

47fcea2010...31.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    47fcea2010c36c1b116a6cc58220ce31.exe
  • Size 825KB
  • Sample220208-b6fmlsbgh5
  • SHA256 8c16cbf4df8137db774d2cb97cc386b052ca7a0b77ee1572fe7a5fc9a5a22ae0
  • MD5 SHA1 SHA512
Score
10/10
formbookqugoratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • qugo

Decoy

  • sathapornstainlesssteel.com

  • everythingisaninvestment.com

  • appsbyraf.com

  • superhornygirl.club

  • christmastreeclass.com

  • cheatdayztogo.com

  • aadent7.com

  • divinitypath.com

  • figuli563.com

  • distanzalojistik.com

  • pricelesslookyto-looktoday.info

  • pcaaems.com

  • itsnewmovie.com

  • 4kx.claims

  • rental-aruyo.com

  • psiek.com

  • justnobleempress.com

  • 40daysfor40nights.com

  • 91266w.com

  • csi-texas.biz

Targets

    • Target
      47fcea2010c36c1b116a6cc58220ce31.exe
    • Size 825KB
    • SHA256 8c16cbf4df8137db774d2cb97cc386b052ca7a0b77ee1572fe7a5fc9a5a22ae0
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookqugoratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks