Overview

overview

10

Static

static

f5aaeb84ea...55.exe

windows7-x64

10

f5aaeb84ea...55.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f5aaeb84ea18e9af249804c9ee505a55.exe
  • Size 1022KB
  • Sample221109-vctf6acbcp
  • SHA256 3c9009eeffcaac6b1e45e26ed3d7c399b42d9a9507cc56ddec477c399a3d9b2f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookua69ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ua69

Decoy

  • uslanmayizz.com

  • rrucrowd.com

  • nerexy.online

  • guolang-clan.com

  • meteleabogados.com

  • sh-gottipati.com

  • themesmiui.com

  • anananlan.com

  • roghanala.com

  • yekitiba.com

  • echoskinco.com

  • btlpour.xyz

  • shoyo-samaa.com

  • fuzzywumpus.net

  • malerzeit.com

  • xiam.online

  • brandibraunalissa.com

  • cryptominis.pro

  • we-living.com

  • dc-invest.online

Targets

    • Target
      f5aaeb84ea18e9af249804c9ee505a55.exe
    • Size 1022KB
    • SHA256 3c9009eeffcaac6b1e45e26ed3d7c399b42d9a9507cc56ddec477c399a3d9b2f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookua69ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks