Overview

overview

10

Static

static

AWB1850018...55.exe

windows7-x64

10

AWB1850018...55.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    AWB18500182174_11355.exe
  • Size 993KB
  • Sample220905-gzwyxaegh2
  • SHA256 7d3f405c5be58b5deeeaedd64e48a02ce7aeff56c435c52d7c0b476ce6c7db5e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooken27ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • en27

Decoy

  • plxfgj.com

  • lesmarines.online

  • vacationsme.us

  • 275by.com

  • bigrodoc.online

  • xjvcwszbwzd.top

  • redplanetinc.com

  • vinyuup.xyz

  • newbrotherprove.top

  • 219961.com

  • ompelimosormustin.info

  • againstaffiliatemarketing.com

  • beautyrealmm.com

  • goldentickethomes.com

  • topfunnel.today

  • peacsolutoins.com

  • sztzywygl.com

  • allfishingtips.com

  • rcgerlnterac.com

  • tasweeneloragahar.info

Targets

    • Target
      AWB18500182174_11355.exe
    • Size 993KB
    • SHA256 7d3f405c5be58b5deeeaedd64e48a02ce7aeff56c435c52d7c0b476ce6c7db5e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooken27ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks