Overview

overview

10

Static

static

c5c4d1d508...3a.exe

windows7_x64

10

c5c4d1d508...3a.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c5c4d1d50862215ec715be1def000f3a
  • Size 780KB
  • Sample220409-h7sf5afba2
  • SHA256 da3faf405c8673426db7d5e6a59fb74f2cb6e0362b6e280a09024ba97dc98dc7
  • MD5 SHA1 SHA512
Score
10/10
formbookr2y0ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • r2y0

Decoy

  • arzoneproperty.com

  • pathtopronetwork.com

  • jasasumurborjawatimur.com

  • albertliang.info

  • subvipndg.site

  • fzmtzs.com

  • qianguodong.xyz

  • artifact-label.com

  • fuss-about.com

  • denimfactorylb.com

  • sbsmwkdnc.com

  • cdspaint.com

  • iloveyour.info

  • ballantineshotels.com

  • infoxcore.com

  • advisorlove.com

  • frauimmond.com

  • vibeplot.com

  • toje2523.xyz

  • masterbetting125.com

Targets

    • Target
      c5c4d1d50862215ec715be1def000f3a
    • Size 780KB
    • SHA256 da3faf405c8673426db7d5e6a59fb74f2cb6e0362b6e280a09024ba97dc98dc7
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookr2y0ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks