Overview

overview

10

Static

static

004343f025...50.exe

windows7-x64

10

004343f025...50.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    004343f0250f145403696f153c3af750.exe
  • Size 704KB
  • Sample230127-vejpqsdf3t
  • SHA256 8dbb132dccc8fb8a83062fec3840b1556a75862c07d22a0740ca095698ed0f6d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookpe63ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • pe63

Decoy

  • iparkshonan.com

  • cahoonset.com

  • chuliji.com

  • judiangka.boats

  • casadecanyonlane.com

  • hukaol.xyz

  • websiteclonescripts.com

  • jjlpoi.com

  • e-insurance.africa

  • buketubalonu.com

  • foruminati.se

  • 12rivalo.xyz

  • bblifebizsolutions.com

  • larimarfitness.com

  • conectado.xyz

  • 511271.com

  • shpte-energy.net

  • thewayit.net

  • jpdentistry.co.uk

  • aisini5201314.love

Targets

    • Target
      004343f0250f145403696f153c3af750.exe
    • Size 704KB
    • SHA256 8dbb132dccc8fb8a83062fec3840b1556a75862c07d22a0740ca095698ed0f6d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookpe63ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks