Overview

overview

10

Static

static

Quotation ...df.exe

windows7_x64

10

Quotation ...df.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Quotation 6000000001863_pdf.exe
  • Size 861KB
  • Sample220712-lerwnsegf2
  • SHA256 9bccba2dd88df736c04d6d657879abe5b3bee28103aecedbba19b91b684d43af
  • MD5 SHA1 SHA512
Score
10/10
formbookir93ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ir93

Decoy

  • dostavka47.store

  • mangguoav.xyz

  • yourhealthstore.life

  • sharpecartoons.com

  • webbankrate.com

  • sublimephotography.online

  • crudepurple.xyz

  • basselibrahim.group

  • peroalkeys.com

  • vntiktokshop.xyz

  • lasarview.com

  • notherdaylope.site

  • hengqijc.com

  • thejamstar.com

  • adityapeen.com

  • bestseeds-21.xyz

  • qaaronautoinsurance.xyz

  • eadservices.online

  • hubei23.com

  • lanenucacontenedor.com

Targets

    • Target
      Quotation 6000000001863_pdf.exe
    • Size 861KB
    • SHA256 9bccba2dd88df736c04d6d657879abe5b3bee28103aecedbba19b91b684d43af
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookir93ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks