Overview

overview

10

Static

static

39002938029_pdf.exe

windows7-x64

10

39002938029_pdf.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    39002938029_pdf.exe
  • Size 258KB
  • Sample220831-n6bd4sdhak
  • SHA256 b5fcf18c0ac1815c33ea1a6691bd69f1897b772184231beaf1e4f3f92882ae3e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooks3s3ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • s3s3

Decoy

  • tvielotus.com

  • teesta.xyz

  • talentrecruitor.com

  • pamaungipb.com

  • xn--90ahkh6a6b8b.site

  • 910carolina.com

  • toyotaecoyouth-dev.com

  • invetnables.com

  • gdexc.com

  • ssw168.com

  • householdmould.com

  • mqttradar.xyz

  • t333c.com

  • thepausestudio.com

  • evershedsutherlands.com

  • asbdataplus.com

  • preddylilthingz.com

  • jepwu.com

  • tvlido.com

  • artovus.com

Targets

    • Target
      39002938029_pdf.exe
    • Size 258KB
    • SHA256 b5fcf18c0ac1815c33ea1a6691bd69f1897b772184231beaf1e4f3f92882ae3e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooks3s3ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks