Overview

overview

10

Static

static

4f279b7fd3...0b.exe

windows7_x64

10

4f279b7fd3...0b.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4f279b7fd35cb88bafb83912c82ae50b.exe
  • Size 981KB
  • Sample220322-xn824aggb4
  • SHA256 e4d0ebfd2e92b3848aa302ff71782e2bb7b55b1340f340c89e263e9d1a2a6987
  • MD5 SHA1 SHA512
Score
10/10
formbookw26eratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • w26e

Decoy

  • alexispageart.com

  • 69253.win

  • luckytimelondon.com

  • 289788.icu

  • houserepairservice.com

  • z-i-z.com

  • onlinediyetsitem.com

  • birkinmetaverse.com

  • unual.com

  • doorbundle.com

  • unplugpropertymanagement.com

  • go-fastcargo.com

  • therestore.agency

  • rubyyyjones.com

  • bavtin.xyz

  • jktwatchweek.com

  • atendimento-app.cloud

  • inavi.xyz

  • topinsurancesecrets.com

  • webgplsolucoes.xyz

Targets

    • Target
      4f279b7fd35cb88bafb83912c82ae50b.exe
    • Size 981KB
    • SHA256 e4d0ebfd2e92b3848aa302ff71782e2bb7b55b1340f340c89e263e9d1a2a6987
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookw26eratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks