Overview

overview

10

Static

static

3f86ffdbda...21.exe

windows7_x64

10

3f86ffdbda...21.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3f86ffdbdaa69708bf989c5067102721.exe
  • Size 642KB
  • Sample220530-eynvsshghr
  • SHA256 cec1e3475be480dcec7b887edfab3389da89c696c99fc99927682f3bc99e208b
  • MD5 SHA1 SHA512
Score
10/10
formbooke63zratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • e63z

Decoy

  • solariefy.com

  • zw323.top

  • somei8.com

  • rukbrook.com

  • iu5w.icu

  • escrow-hk.com

  • onlinereviewmonitor.com

  • maxxaktiv.com

  • directecole.com

  • walkinmovies.com

  • zxxiangr.com

  • prvmagapromo.com

  • mozogaotaxi.com

  • paralegaltraining.life

  • hayatkulturvakifi.com

  • beltmnn.com

  • olqlovea.com

  • theupsstore881.com

  • galmfrenchbulldogsny.com

  • stphilcc.com

Targets

    • Target
      3f86ffdbdaa69708bf989c5067102721.exe
    • Size 642KB
    • SHA256 cec1e3475be480dcec7b887edfab3389da89c696c99fc99927682f3bc99e208b
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooke63zratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks