Overview

overview

10

Static

static

3

70ba285739...c8.exe

windows7-x64

10

70ba285739...c8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    70ba285739cca49de3c60779e2d3b8c8.exe
  • Size 656KB
  • Sample230428-m9qsjade85
  • SHA256 a85d2aa65e5b5d69769ff7dd1a63e90de9bd7f96a76fa96c52137587b63d1016
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooktf6pratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • tf6p

Decoy

  • poolcleanerskingsland.com

  • nieveslandscapee.com

  • wb263.com

  • smartlubetrading.com

  • linuowen.com

  • fna-seattle.com

  • jobgenie-ai.com

  • mycocktailmind.com

  • openai-invite.com

  • tnndjf5kyxz.com

  • mclane.attorney

  • somwear.xyz

  • spliffstudios.com

  • grupofaace.com

  • wuuwo.com

  • bigtimerushcharlotte.com

  • yourercchecks.com

  • arportablepottyrentals.biz

  • sbtsanantonio.com

  • explantationsbegleitung.com

Targets

    • Target
      70ba285739cca49de3c60779e2d3b8c8.exe
    • Size 656KB
    • SHA256 a85d2aa65e5b5d69769ff7dd1a63e90de9bd7f96a76fa96c52137587b63d1016
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooktf6pratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks