Overview

overview

10

Static

static

3

Items List...C..exe

windows7-x64

10

Items List...C..exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Items Listed In Detail RFQ_2804024_KTC..exe
  • Size 665KB
  • Sample230502-jkvhmsaa99
  • SHA256 bfede26656dbab01c01f5187f8a5d9b63cd0f8bba301e8c1d145bda515960f02
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookks01ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ks01

Decoy

  • glchqx.com

  • acpwatertreatment.co.uk

  • hannahschepmann.com

  • cvcv49.top

  • crazy-for-promotion.online

  • goldstreamacademy.africa

  • erasure.monster

  • judiangka.boats

  • fli.group

  • 94ebuy.com

  • enjoyvet.com

  • box618.shop

  • formdr.dev

  • rivierabathrooms.co.uk

  • drawntocolour.com

  • digitalworldobserver.com

  • lonelinessindex.com

  • coachifyfunnels.com

  • abeloewen.com

  • bahujan.store

Targets

    • Target
      Items Listed In Detail RFQ_2804024_KTC..exe
    • Size 665KB
    • SHA256 bfede26656dbab01c01f5187f8a5d9b63cd0f8bba301e8c1d145bda515960f02
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookks01ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks