Overview

overview

10

Static

static

2133a5f54d...12.exe

windows7_x64

10

2133a5f54d...12.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2133a5f54d66420dc2940bb0a5b4ba12
  • Size 710KB
  • Sample220629-l9ppssgffr
  • SHA256 7d9650c0643e34d7b2485adaba2e2e2171e769d99e61839bda67e38cb595c312
  • MD5 SHA1 SHA512
Score
10/10
formbooks0s2ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • s0s2

Decoy

  • stripe-forecast.com

  • perfectingnextstage.com

  • primarole.com

  • nonnydesigns.com

  • wordsofweightandlevity.com

  • mafleursam.com

  • hardwarepicker.tech

  • minex-intl.com

  • thenextbigtech.net

  • rabeproject.com

  • sticktogracestudio.com

  • releve.space

  • readoku.net

  • carings.net

  • nasdaq-ex.store

  • au-techng.com

  • thethoughtgenius.com

  • how-to-learn-languages.net

  • kitabisabelanja.com

  • awndka.xyz

Targets

    • Target
      2133a5f54d66420dc2940bb0a5b4ba12
    • Size 710KB
    • SHA256 7d9650c0643e34d7b2485adaba2e2e2171e769d99e61839bda67e38cb595c312
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooks0s2ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks