Overview

overview

10

Static

static

3

rPAGOA31900.exe

windows7-x64

10

rPAGOA31900.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    rPAGOA31900.exe
  • Size 629KB
  • Sample230509-nby7pafe47
  • SHA256 70d1125e7b5eeec17ca0248a72e7ea949bb78364928423d5ec062bd4e7eb825a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookin62ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • in62

Decoy

  • daniellemalton.com

  • digitalmagazine.online

  • ceroemisiones.net

  • advdbg.com

  • sxcontu.xyz

  • aerialcomedy.com

  • clevershopus.com

  • lebanoncabledawgs.com

  • shanquella.com

  • tea-ignite.net

  • hesank.net

  • gawkyyaffect.com

  • htmastodonapp.uk

  • digitalsolutionscx.com

  • estymuelsintegrated.africa

  • craigslist25.com

  • hotel-coto.xyz

  • gistus.africa

  • jamesthomas.online

  • blopresmonll.com

Targets

    • Target
      rPAGOA31900.exe
    • Size 629KB
    • SHA256 70d1125e7b5eeec17ca0248a72e7ea949bb78364928423d5ec062bd4e7eb825a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookin62ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks