Overview

overview

10

Static

static

1

50fe8f68de...8d.exe

windows7-x64

10

50fe8f68de...8d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d

  • Size

    349KB

  • Sample

    230308-pn7v2afg5z

  • MD5

    ba645c8235d19c8407c81d62470eedf8

  • SHA1

    9b78b515d6869753e2bb3e46d1307deccef79e57

  • SHA256

    50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d

  • SHA512

    7efa198fd976f2660fc033f708739c003210ae88e50938abec6ce919e85246ca4a6d4f3db0e105b16094b08a68ad1234b5986cfed43c90b239369a46e95a65de

  • SSDEEP

    6144:jYa6a3R6bVzifniXpVKRNQfgwq+DMhfii10dqeH+QE:jY03RYV+Op8Ugwq+HiSg0PE

Score
10/10
formbookho62ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ho62

Decoy

aqawonky.com

ancachsroadsideassistance.com

artologycreatlive.com

olesinfo.africa

lovebreatheandsleep.com

friendsofdragonsprings.com

homecomingmums.wiki

hg222.bet

precision-spares.co.uk

generalhospitaleu.africa

touchstone4x4.africa

dynamator.com

dental-implants-52531.com

efefear.buzz

bentonapp.net

89luxu.com

bridgesonelm.com

acesaigon.online

instantapprovals.loans

evuniverso.com

Targets

    • Target

      50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d

    • Size

      349KB

    • MD5

      ba645c8235d19c8407c81d62470eedf8

    • SHA1

      9b78b515d6869753e2bb3e46d1307deccef79e57

    • SHA256

      50fe8f68de11579bdf0d4703cc9e6a1f0f9817a5605b15977c229bf5c522338d

    • SHA512

      7efa198fd976f2660fc033f708739c003210ae88e50938abec6ce919e85246ca4a6d4f3db0e105b16094b08a68ad1234b5986cfed43c90b239369a46e95a65de

    • SSDEEP

      6144:jYa6a3R6bVzifniXpVKRNQfgwq+DMhfii10dqeH+QE:jY03RYV+Op8Ugwq+HiSg0PE

    Score
    10/10
    formbookho62ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks