Overview

overview

10

Static

static

Re.offer.exe

windows7-x64

10

Re.offer.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Re.offer.exe
  • Size 955KB
  • Sample221025-gva6msbfh7
  • SHA256 c0f5e01dded221a720c2173447e936c1e1148928016187fa4e8ac8e3a087b4ee
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookng04ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ng04

Decoy

  • tevimaq.com

  • easterspecialtystore.com

  • smartlever.tech

  • 10312.uk

  • tanjawiharbi.co.uk

  • 471338.com

  • horusventure.com

  • empress-care.com

  • sinrian.com

  • 465951.com

  • aemsti.com

  • nxcourier.com

  • stargatefarms.com

  • lalyquainvestment.com

  • dailysportsadvice.com

  • justlistmoore.com

  • stoneonroll.online

  • tatianakolomiets.com

  • barcodebbm.com

  • protectorship.world

Targets

    • Target
      Re.offer.exe
    • Size 955KB
    • SHA256 c0f5e01dded221a720c2173447e936c1e1148928016187fa4e8ac8e3a087b4ee
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookng04ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks