Overview

overview

10

Static

static

fcaf1de8fe...69.exe

windows7_x64

10

fcaf1de8fe...69.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    fcaf1de8fea0ac779b0abc17a1029969
  • Size 688KB
  • Sample220412-pnwsrseee2
  • SHA256 75b7d30e6f26fbb3fbac284ed75356cc874e73365764130209d4937d80a6c80d
  • MD5 SHA1 SHA512
Score
10/10
formbookb2a4ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • b2a4

Decoy

  • firstrootsfarmmi.com

  • haywardsh.xyz

  • duocnamson.com

  • theginhanh.net

  • camilisboutique.com

  • wilsonmarble.com

  • lakelandhs1980.com

  • wilmington.expert

  • askartoon.com

  • sedox-web.com

  • avantgardespiritof.com

  • menofspeed.com

  • veniceclothing.com

  • banaqi.com

  • churchmediaroom.com

  • hawaiivog.com

  • healthyplantet.com

  • weidenhaft.com

  • atmcml.com

  • shaokangjiu.com

Targets

    • Target
      fcaf1de8fea0ac779b0abc17a1029969
    • Size 688KB
    • SHA256 75b7d30e6f26fbb3fbac284ed75356cc874e73365764130209d4937d80a6c80d
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookb2a4ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks