Overview

overview

10

Static

static

3

dc7614d708...1c.exe

windows7-x64

10

dc7614d708...1c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    dc7614d708b3b80811a4c8dde9eb4e1c.exe
  • Size 711KB
  • Sample230522-a9r95sdb72
  • SHA256 a8982b67f297cc68ff3f3de02cc7b60d51c8b4a3db85971ce4f73149fe67b6ee
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookpr29ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • pr29

Decoy

  • venuelees.co.uk

  • izquitlmichigan.com

  • 33456.biz

  • birdieveneer.online

  • happydaysenniskillen.com

  • mybfhoodie.com

  • 8xanre.xyz

  • liberaltimes.africa

  • arnoza-clothing.ch

  • enhancedintimacy.com

  • 911halocampus.com

  • kx1179.com

  • generate-industries.com

  • starshiptransports.com

  • process-strategies.net

  • lovemichigancity.com

  • brezentovye-shtory.ru

  • calforze.com

  • ashenyrebirth.com

  • fgjfytryur6787api15.xyz

Targets

    • Target
      dc7614d708b3b80811a4c8dde9eb4e1c.exe
    • Size 711KB
    • SHA256 a8982b67f297cc68ff3f3de02cc7b60d51c8b4a3db85971ce4f73149fe67b6ee
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookpr29ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks