Overview

overview

10

Static

static

8c3fe5b317...09.exe

windows7_x64

1

8c3fe5b317...09.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8c3fe5b3177bdef904c64cb1b65d1009.exe
  • Size 772KB
  • Sample220412-p2b1hsbdgr
  • SHA256 e9a5fa1e217bd7dbbb5b055250c3818d3372a77cfe3cb2f397e251583accfd6f
  • MD5 SHA1 SHA512
Score
10/10
formbookg02eratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • g02e

Decoy

  • rankwrestles.com

  • dm285.com

  • 0824e.com

  • smaduread.com

  • staygoodbossedup.com

  • actacricket.xyz

  • djpauloso.com

  • collingwoodwellbabyclinic.com

  • fazzamedia.com

  • faento.online

  • devoteddixons.com

  • ljconcierto.com

  • dallasmorningpost.com

  • changledi.com

  • sz-lyfw.com

  • askdigiguru.com

  • aihongyan.com

  • educanet12.com

  • accedabancsabadell.com

  • vetkoekworld.com

Targets

    • Target
      8c3fe5b3177bdef904c64cb1b65d1009.exe
    • Size 772KB
    • SHA256 e9a5fa1e217bd7dbbb5b055250c3818d3372a77cfe3cb2f397e251583accfd6f
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookg02eratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks