Overview

overview

10

Static

static

43723f48e5...fc.exe

windows7_x64

10

43723f48e5...fc.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    43723f48e53efb30d879a7e914303ffc.exe
  • Size 508KB
  • Sample220628-mg376aggel
  • SHA256 b945450834c1b291b59ad3e4360a4493657dbff4dc653cc593eca008ee4f49db
  • MD5 SHA1 SHA512
Score
10/10
formbookrv4kratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • rv4k

Decoy

  • superviga.store

  • chainloom.com

  • blogvocecomsaude.tech

  • kencurrie.site

  • jobtreffer.com

  • training-motivation-health.com

  • calm-world.xyz

  • landata-cc.com

  • ranssbt.com

  • teaburn.host

  • enmodocheckin.com

  • luvelwano.net

  • soulzofafrika.com

  • sallyhawkins.net

  • itsshebesteph.com

  • 220169.com

  • oracasatua.info

  • lauthentique-sbh.store

  • herpediscount.one

  • taobaohuangye.com

Targets

    • Target
      43723f48e53efb30d879a7e914303ffc.exe
    • Size 508KB
    • SHA256 b945450834c1b291b59ad3e4360a4493657dbff4dc653cc593eca008ee4f49db
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookrv4kratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks