Overview

overview

10

Static

static

3

06f6f50ba7...1b.exe

windows7-x64

10

06f6f50ba7...1b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    06f6f50ba73ed99075acfad2e0c13a1b.exe
  • Size 807KB
  • Sample230619-hfrqhsdc91
  • SHA256 2968df5307f5f87cf57d3f470edea04d1fad9b3a60426e59bbaccd5ab0b0a543
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooksr62ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • sr62

Decoy

  • byosphere.com

  • faf2.com

  • dj4.rent

  • homelaver.com

  • snailmucinessence.com

  • msioxh-fmht.click

  • 43811.top

  • 7l89.sbs

  • llmnissan976.vip

  • seasourceconsulting.com

  • iistwebinar.com

  • m-800bets10.com

  • huan886.com

  • zb3j3dfz.cyou

  • gy8872.xyz

  • jamesjoy.site

  • seseri-diary.com

  • torzosteku.cfd

  • chalbeystarbail.online

  • bryanapontetattoos.online

Targets

    • Target
      06f6f50ba73ed99075acfad2e0c13a1b.exe
    • Size 807KB
    • SHA256 2968df5307f5f87cf57d3f470edea04d1fad9b3a60426e59bbaccd5ab0b0a543
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooksr62ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks