Overview

overview

10

Static

static

d4fb3af72c...95.exe

windows7_x64

10

d4fb3af72c...95.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    d4fb3af72cac67572aae9a16bb859795
  • Size 622KB
  • Sample220610-mtyhfaefa6
  • SHA256 d16928ea116bf3bfb6f3b51c833fd52a540e645ba60ef8842b4750cdd33080bb
  • MD5 SHA1 SHA512
Score
10/10
formbookcy84ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • cy84

Decoy

  • buymarijuana.website

  • mars-house.com

  • highloopkids.com

  • hengjialives.online

  • hht5292.com

  • yiniu54.xyz

  • baykuscuksapsap.net

  • lzzcxx.com

  • nbchangshun.com

  • backfields.farm

  • randacominternet.xyz

  • bralumi.online

  • sportsorb.com

  • graveounce.online

  • dddsss222.com

  • xiaojuju.site

  • returns-nagoya.com

  • tepinvestmentbeylikduzu.com

  • 81796.land

  • thisisit972.com

Targets

    • Target
      d4fb3af72cac67572aae9a16bb859795
    • Size 622KB
    • SHA256 d16928ea116bf3bfb6f3b51c833fd52a540e645ba60ef8842b4750cdd33080bb
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookcy84ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks