Overview

overview

10

Static

static

svchost.exe

windows7_x64

1

svchost.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    svchost.exe
  • Size 803KB
  • Sample220307-rx15ysfdc5
  • SHA256 a6525de47e9c194acea3d0048b4633a9bb0f0bab0bfe2eb5e1ec3aa126909e32
  • MD5 SHA1 SHA512
Score
10/10
formbookw26eratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • w26e

Decoy

  • alexispageart.com

  • 69253.win

  • luckytimelondon.com

  • 289788.icu

  • houserepairservice.com

  • z-i-z.com

  • onlinediyetsitem.com

  • birkinmetaverse.com

  • unual.com

  • doorbundle.com

  • unplugpropertymanagement.com

  • go-fastcargo.com

  • therestore.agency

  • rubyyyjones.com

  • bavtin.xyz

  • jktwatchweek.com

  • atendimento-app.cloud

  • inavi.xyz

  • topinsurancesecrets.com

  • webgplsolucoes.xyz

Targets

    • Target
      svchost.exe
    • Size 803KB
    • SHA256 a6525de47e9c194acea3d0048b4633a9bb0f0bab0bfe2eb5e1ec3aa126909e32
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookw26eratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks