Overview

overview

10

Static

static

ZB_1997e758e3.exe

windows7-x64

10

ZB_1997e758e3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ZB_1997e758e3.exe

  • Size

    487KB

  • Sample

    220801-skk4msbehk

  • MD5

    25d40c676222d431691223ea256c5be0

  • SHA1

    844e84f81a6fcb00af333793bccdf960377dd7d0

  • SHA256

    76b075d9a92f124e01df0a2c3f86ea729666db05b813d499fb3ce6d2402f42d9

  • SHA512

    1e140f4427fd5989b28827169126445c2bf7a8059a3279fa419c9d8280998e1c005234d1a5c3bf87a79d527adf153ccf199e070a0ae9ab2bef62437d3fd76161

Score
10/10
formbookmh76ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

mh76

Decoy

healthgovcalottery.net

wenxinliao.com

rooterphd.com

bbobbo.one

american-mes-de-dezembro.xyz

mintager.com

thespecialtstore.com

wemakegreenhomes.com

occurandmental.xyz

fidelityrealtytitle.com

numerisat.asia

wearestallions.com

supxl.com

rajacumi.com

renaziv.online

blixtindustries.com

fjljq.com

exploretrivenicamping.com

authenticusspa.com

uucloud.press

Targets

    • Target

      ZB_1997e758e3.exe

    • Size

      487KB

    • MD5

      25d40c676222d431691223ea256c5be0

    • SHA1

      844e84f81a6fcb00af333793bccdf960377dd7d0

    • SHA256

      76b075d9a92f124e01df0a2c3f86ea729666db05b813d499fb3ce6d2402f42d9

    • SHA512

      1e140f4427fd5989b28827169126445c2bf7a8059a3279fa419c9d8280998e1c005234d1a5c3bf87a79d527adf153ccf199e070a0ae9ab2bef62437d3fd76161

    Score
    10/10
    formbookmh76ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks