Overview

overview

10

Static

static

3

23-QAI-OPS...CS.exe

windows7-x64

10

23-QAI-OPS...CS.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    23-QAI-OPS-0067 (7000000061)DOCS.exe
  • Size 271KB
  • Sample230620-kwky1sba97
  • SHA256 98af1f3c5432305b017b9d94ee5e4f7c9aef070f5cfbbcddda83f6ee7efce263
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookrx63ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • rx63

Decoy

  • prepandgo.net

  • nnkkd.com

  • like-clinic.ru

  • begladgardens.com

  • dirlkit.online

  • elegantshopee.com

  • beesleyandco.com

  • ievt.africa

  • hrmyy.com

  • 4everlovinpets.com

  • benelu-duodefils.com

  • impressivehistory.com

  • visiogeomatics.africa

  • quorbis.net

  • jannatholidays.com

  • amazing-cajun.com

  • bipartisan.one

  • 9535.football

  • bbnlotto.africa

  • dollardstown.com

Targets

    • Target
      23-QAI-OPS-0067 (7000000061)DOCS.exe
    • Size 271KB
    • SHA256 98af1f3c5432305b017b9d94ee5e4f7c9aef070f5cfbbcddda83f6ee7efce263
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookrx63ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks