Overview

overview

10

Static

static

57193e3987...3c.exe

windows7_x64

10

57193e3987...3c.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    57193e39870b4ebfedd8b541b90f7d3c
  • Size 853KB
  • Sample220209-qlpr4sadf8
  • SHA256 ce931ede894759cdd518d9dd8f4a9888b7fa3656bd6fa3bc0b66514b985efb5d
  • MD5 SHA1 SHA512
Score
10/10
formbookk2i4ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • k2i4

Decoy

  • apehangersbikersgang.com

  • lhcgrou.com

  • diveidf.com

  • timtas.store

  • jadebody.club

  • iamjbrussell.com

  • fwfuv.icu

  • picchealth.net

  • batuair.com

  • z58609.com

  • punarecotech.com

  • a-oct.com

  • xn--wmq0c1qt9mcxhxjkp16a.top

  • district99.net

  • 5dcoding.com

  • aripagripoff.biz

  • abtheagent.com

  • betterskincareco.com

  • jsskylight.com

  • deviseoffice.com

Targets

    • Target
      57193e39870b4ebfedd8b541b90f7d3c
    • Size 853KB
    • SHA256 ce931ede894759cdd518d9dd8f4a9888b7fa3656bd6fa3bc0b66514b985efb5d
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookk2i4ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks