Overview

overview

10

Static

static

3

5bc95f5d8d...45.exe

windows7-x64

10

5bc95f5d8d...45.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5bc95f5d8d3bf878098d8527bc679545.exe
  • Size 680KB
  • Sample230502-pg7lpaba55
  • SHA256 9c3d5704da83029f78ee8cf532c746cd04834f5375a698f21c50040ade6c5a09
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookks01ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ks01

Decoy

  • glchqx.com

  • acpwatertreatment.co.uk

  • hannahschepmann.com

  • cvcv49.top

  • crazy-for-promotion.online

  • goldstreamacademy.africa

  • erasure.monster

  • judiangka.boats

  • fli.group

  • 94ebuy.com

  • enjoyvet.com

  • box618.shop

  • formdr.dev

  • rivierabathrooms.co.uk

  • drawntocolour.com

  • digitalworldobserver.com

  • lonelinessindex.com

  • coachifyfunnels.com

  • abeloewen.com

  • bahujan.store

Targets

    • Target
      5bc95f5d8d3bf878098d8527bc679545.exe
    • Size 680KB
    • SHA256 9c3d5704da83029f78ee8cf532c746cd04834f5375a698f21c50040ade6c5a09
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookks01ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks