Overview

overview

10

Static

static

09a39bd1ee...1e.exe

windows7_x64

10

09a39bd1ee...1e.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    09a39bd1ee075d36c3e713e8e70ca01e.exe
  • Size 981KB
  • Sample220323-yr6a2saeb6
  • SHA256 5d73c1ce4d0c8beea33b6eaef76d82e389d139d8e6caa17c2767c70889697c3b
  • MD5 SHA1 SHA512
Score
10/10
formbookm0a8ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • m0a8

Decoy

  • yamaibito.net

  • mutedao.com

  • rumory.info

  • firetowerbusinesscampus.com

  • 40lhe9l.cfd

  • shainy.net

  • theopengoal.com

  • lasjet.com

  • webdoker.com

  • middlegeorgiastatecollege.com

  • easykart.info

  • eriremyufka.com

  • dulavituglaw.com

  • okilife.net

  • xishuicn.com

  • yellowarmbands.com

  • hellotwinsies.com

  • bardertech.com

  • leonshub.com

  • activetrade.xyz

Targets

    • Target
      09a39bd1ee075d36c3e713e8e70ca01e.exe
    • Size 981KB
    • SHA256 5d73c1ce4d0c8beea33b6eaef76d82e389d139d8e6caa17c2767c70889697c3b
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookm0a8ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks