Overview

overview

10

Static

static

cb5cd9f825...b4.exe

windows7_x64

10

cb5cd9f825...b4.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    cb5cd9f8250eaf3861f8774f431032b4
  • Size 400KB
  • Sample220209-mfzhksaaa3
  • SHA256 7357d3e9a33b53dcaf335fecb11100acf0fbeeec2ebf668634de7cd1ba931ae1
  • MD5 SHA1 SHA512
Score
10/10
formbookk2i4ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • k2i4

Decoy

  • apehangersbikersgang.com

  • lhcgrou.com

  • diveidf.com

  • timtas.store

  • jadebody.club

  • iamjbrussell.com

  • fwfuv.icu

  • picchealth.net

  • batuair.com

  • z58609.com

  • punarecotech.com

  • a-oct.com

  • xn--wmq0c1qt9mcxhxjkp16a.top

  • district99.net

  • 5dcoding.com

  • aripagripoff.biz

  • abtheagent.com

  • betterskincareco.com

  • jsskylight.com

  • deviseoffice.com

Targets

    • Target
      cb5cd9f8250eaf3861f8774f431032b4
    • Size 400KB
    • SHA256 7357d3e9a33b53dcaf335fecb11100acf0fbeeec2ebf668634de7cd1ba931ae1
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookk2i4ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks