Overview

overview

10

Static

static

0ce75681d8...83.exe

windows7_x64

10

0ce75681d8...83.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0ce75681d8d374446f47f8e3e3506e83
  • Size 543KB
  • Sample220627-trclhscchj
  • SHA256 05b1cd603281b2bcdd1f29d7c48f75a7e8fa63c4f3c14a17d7c155465896fdff
  • MD5 SHA1 SHA512
Score
10/10
formbookrv4kratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • rv4k

Decoy

  • superviga.store

  • chainloom.com

  • blogvocecomsaude.tech

  • kencurrie.site

  • jobtreffer.com

  • training-motivation-health.com

  • calm-world.xyz

  • landata-cc.com

  • ranssbt.com

  • teaburn.host

  • enmodocheckin.com

  • luvelwano.net

  • soulzofafrika.com

  • sallyhawkins.net

  • itsshebesteph.com

  • 220169.com

  • oracasatua.info

  • lauthentique-sbh.store

  • herpediscount.one

  • taobaohuangye.com

Targets

    • Target
      0ce75681d8d374446f47f8e3e3506e83
    • Size 543KB
    • SHA256 05b1cd603281b2bcdd1f29d7c48f75a7e8fa63c4f3c14a17d7c155465896fdff
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookrv4kratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks