Overview

overview

10

Static

static

b73fd744a0...bc.exe

windows7_x64

10

b73fd744a0...bc.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b73fd744a06524f04f0582822348f1bc
  • Size 911KB
  • Sample220301-wm1tnacehj
  • SHA256 9577df8b7e48bb30b9bd48e49c548d45cc5cc4a9bf1b93aa79f4ab35fc977cb3
  • MD5 SHA1 SHA512
Score
10/10
formbookg2e7ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • g2e7

Decoy

  • onlinebankaccess.com

  • dekannabesetale.com

  • cevaszakszervezet.com

  • barok-music.com

  • civitanova.info

  • projectpeaks.tech

  • orderoaxacarestaurant.com

  • lazatee.com

  • mufduds.com

  • ivyfitfun.com

  • justtwotrade.com

  • dnvkcpe.com

  • ecomnabe.com

  • digitalcourse.biz

  • placemonthwaylife.biz

  • redfoxbet.info

  • realitysweetz.com

  • angyhouse.com

  • bapqnm.com

  • parsmicron.com

Targets

    • Target
      b73fd744a06524f04f0582822348f1bc
    • Size 911KB
    • SHA256 9577df8b7e48bb30b9bd48e49c548d45cc5cc4a9bf1b93aa79f4ab35fc977cb3
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookg2e7ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks