Overview

overview

10

Static

static

3

8a8c6d76e7...70.exe

windows7-x64

10

8a8c6d76e7...70.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8a8c6d76e723e91a0ce4cf14bbea1670.exe
  • Size 706KB
  • Sample230511-e5dcmsbf96
  • SHA256 908518191aecf6570fc10b1d299d64b2ac02f250fe17198a2407a9e12ddfcd30
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooktf6pratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • tf6p

Decoy

  • poolcleanerskingsland.com

  • nieveslandscapee.com

  • wb263.com

  • smartlubetrading.com

  • linuowen.com

  • fna-seattle.com

  • jobgenie-ai.com

  • mycocktailmind.com

  • openai-invite.com

  • tnndjf5kyxz.com

  • mclane.attorney

  • somwear.xyz

  • spliffstudios.com

  • grupofaace.com

  • wuuwo.com

  • bigtimerushcharlotte.com

  • yourercchecks.com

  • arportablepottyrentals.biz

  • sbtsanantonio.com

  • explantationsbegleitung.com

Targets

    • Target
      8a8c6d76e723e91a0ce4cf14bbea1670.exe
    • Size 706KB
    • SHA256 908518191aecf6570fc10b1d299d64b2ac02f250fe17198a2407a9e12ddfcd30
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooktf6pratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks