Overview

overview

10

Static

static

1

e17b0be6e0...d8.exe

windows7-x64

10

e17b0be6e0...d8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    e17b0be6e0c42a0c39c5da63523af8d8.exe
  • Size 530KB
  • Sample221209-yspdxseb56
  • SHA256 7eb67be31871fe9316bbb2ba993b6dfd13cb9e7e04a2e1091b934746399e5293
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookwh23ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • wh23

Decoy

  • ow9vyvfee.com

  • alvis.one

  • mutantgobz.claims

  • plynofon.com

  • southofkingst.store

  • nuvidamedspa.com

  • coffeeforyou56.com

  • opaletechevents.com

  • momobar.life

  • abcmousu.com

  • learnicd-11.com

  • tipokin.xyz

  • kahvezevki.com

  • suratdimond.com

  • oldartists.best

  • infoepic.info

  • mattresslabo.com

  • skarlmotors.com

  • cl9319x.xyz

  • med49app.net

Targets

    • Target
      e17b0be6e0c42a0c39c5da63523af8d8.exe
    • Size 530KB
    • SHA256 7eb67be31871fe9316bbb2ba993b6dfd13cb9e7e04a2e1091b934746399e5293
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookwh23ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks