Overview

overview

10

Static

static

3

6980c552a8...9f.exe

windows7-x64

10

6980c552a8...9f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe
  • Size 732KB
  • Sample230608-n456psfa94
  • SHA256 6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookca82ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ca82

Decoy

  • idunresearch.com

  • loiioo1.site

  • aimobilify.com

  • limousineswebdesign.com

  • darshan-enterprises.online

  • javad.top

  • dd-spy.com

  • metamysme.co.uk

  • earticlesdirect.com

  • ldkj78v.vip

  • dariusevory.com

  • bestyoutubepromoter.com

  • dogcoinacademy.com

  • mestredosexo.net

  • mrnofree.africa

  • plan.rsvp

  • hoangnam.site

  • cadcamperform.com

  • 091888.net

  • artwaylogistics.com

Targets

    • Target
      6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f.exe
    • Size 732KB
    • SHA256 6980c552a8fccf4806027dc577cb1be5dd3e12612053494ce81ba528667ddd9f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookca82ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks