Overview

overview

10

Static

static

RE,RE,New ...er.exe

windows7-x64

10

RE,RE,New ...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RE,RE,New quotations order.exe

  • Size

    864KB

  • Sample

    221215-anyj2aed4z

  • MD5

    00369210e1e8b7cc2baad294252a2417

  • SHA1

    00b8fe2bbbd4830b9e58993432578571d7b6324a

  • SHA256

    2de425eff8193440b8b171e724acec8404b9d81ec48600847946b2b828b494f0

  • SHA512

    8caac64a4fd7db6a19704c36585ed4740a26ee717a7d25b876435831af67c85135de39ecb73b2def38c337cab2b9d73445fa05752bd5cadb3f889557bef40adb

  • SSDEEP

    24576:Q8Dstl9EUzgshx+BPvzWalgZznIehdnp:QAst33ZWnzdlOn13np

Score
10/10
formbookng04ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Targets

    • Target

      RE,RE,New quotations order.exe

    • Size

      864KB

    • MD5

      00369210e1e8b7cc2baad294252a2417

    • SHA1

      00b8fe2bbbd4830b9e58993432578571d7b6324a

    • SHA256

      2de425eff8193440b8b171e724acec8404b9d81ec48600847946b2b828b494f0

    • SHA512

      8caac64a4fd7db6a19704c36585ed4740a26ee717a7d25b876435831af67c85135de39ecb73b2def38c337cab2b9d73445fa05752bd5cadb3f889557bef40adb

    • SSDEEP

      24576:Q8Dstl9EUzgshx+BPvzWalgZznIehdnp:QAst33ZWnzdlOn13np

    Score
    10/10
    formbookng04ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks