Overview

overview

10

Static

static

3

AWB728590890733.exe

windows7-x64

10

AWB728590890733.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    AWB728590890733.exe
  • Size 710KB
  • Sample230606-pt2k7sdf62
  • SHA256 44ca2fb5336865c635d0c1f4c75cfecec1b4fad8fe3de812c048c223cc06fba3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookcs94ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • cs94

Decoy

  • dhaliwal3.com

  • iptvebay.shop

  • hsfgass33.top

  • cammali.com

  • dcleaningseevicesltd.co.uk

  • amzosecsn-jp.icu

  • builtmedia.co.uk

  • duoguang.top

  • forumken.net

  • cqivrh.cfd

  • lr-nexusark.com

  • carrirae.shop

  • jtownexclusive.africa

  • georoiddemo.online

  • lefinet.com

  • otc.rsvp

  • kitchenpharmacy.co.uk

  • bbywafz248xca4.com

  • digijockey.com

  • 9-ji.com

Targets

    • Target
      AWB728590890733.exe
    • Size 710KB
    • SHA256 44ca2fb5336865c635d0c1f4c75cfecec1b4fad8fe3de812c048c223cc06fba3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookcs94ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks