Overview

overview

10

Static

static

1

7f0278286e...87.exe

windows7_x64

10

7f0278286e...87.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    7f0278286e42d3cef1739db8d7865e87
  • Size 270KB
  • Sample220208-ymjw9aead6
  • SHA256 f556af7cd24cc02eba24924d19c42966a1a98b84dfabd78c523c55f492d54acd
  • MD5 SHA1 SHA512
Score
10/10
formbookby73ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • by73

Decoy

  • advertencys.info

  • printableminis.com

  • mjahpr.icu

  • workremotehome.com

  • es-dailynews.info

  • zaryard.com

  • your-bakemark.com

  • metalypsis.com

  • primehomerealtyut.com

  • turbantechie.com

  • dd-mhgj.com

  • earnwithcryptocurrency.com

  • xn--8dbh2c.com

  • trainopia.com

  • plysec.xyz

  • avis-tente.com

  • pitabel.com

  • gabriannanails.com

  • thebipolarpenguin.com

  • alumistarcomponentes.com

Targets

    • Target
      7f0278286e42d3cef1739db8d7865e87
    • Size 270KB
    • SHA256 f556af7cd24cc02eba24924d19c42966a1a98b84dfabd78c523c55f492d54acd
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookby73ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks