Overview

overview

10

Static

static

14ba954e55...f2.exe

windows7_x64

10

14ba954e55...f2.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    14ba954e55194b6aeaad53ed548500f2
  • Size 1000KB
  • Sample220321-l58bcabbg4
  • SHA256 9621e6459dc138fb11bc279b6583fc68eed0db7b284e198c74dda8385db8ce0d
  • MD5 SHA1 SHA512
Score
10/10
formbookw26eratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • w26e

Decoy

  • alexispageart.com

  • 69253.win

  • luckytimelondon.com

  • 289788.icu

  • houserepairservice.com

  • z-i-z.com

  • onlinediyetsitem.com

  • birkinmetaverse.com

  • unual.com

  • doorbundle.com

  • unplugpropertymanagement.com

  • go-fastcargo.com

  • therestore.agency

  • rubyyyjones.com

  • bavtin.xyz

  • jktwatchweek.com

  • atendimento-app.cloud

  • inavi.xyz

  • topinsurancesecrets.com

  • webgplsolucoes.xyz

Targets

    • Target
      14ba954e55194b6aeaad53ed548500f2
    • Size 1000KB
    • SHA256 9621e6459dc138fb11bc279b6583fc68eed0db7b284e198c74dda8385db8ce0d
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookw26eratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks