Overview

overview

10

Static

static

formbook5.exe

windows7-x64

10

Resubmissions

25/10/2022, 14:04

221025-rdmhfschd510

25/10/2022, 13:32

221025-qs4jvachar10

Sharing

Copy URL Twitter E-mail

General

  • Target
    formbook5.zip
  • Size 589KB
  • Sample221025-rdmhfschd5
  • SHA256 392d84c160a17dd93a78b8549f5298d43d1f2ead6d236a1780bc290cc864e615
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookgs25ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • gs25

Decoy

  • real-food.store

  • marketdatalibrary.com

  • jolidens.space

  • ydental.info

  • tattoosbyjayinked.com

  • buytradesellpei.com

  • 61983.xyz

  • identitysolver.xyz

  • mgfang.com

  • teizer.one

  • staychillax.com

  • ylanzarote.com

  • workte.net

  • maukigato.shop

  • coolbag.site

  • btya1r.com

  • dkhaohao.shop

  • zugaro.xyz

  • boon168.com

  • xn--80aeegahlwtdkp.com

Targets

    • Target
      formbook5.exe
    • Size 718KB
    • SHA256 37e9f15077e6491eade2a03b73b9f48b0037c6995a5fbecdae7a942710d1dde1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookgs25ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks