Overview

overview

10

Static

static

3

Quotation.exe

windows7-x64

10

Quotation.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Quotation.rar
  • Size 573KB
  • Sample230629-nte7jach43
  • SHA256 2ee6fb6a93174c53b1de3fb881ff50f06ff33a03337b6cb8d37bd562b18eda13
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookcs94ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • cs94

Decoy

  • dhaliwal3.com

  • iptvebay.shop

  • hsfgass33.top

  • cammali.com

  • dcleaningseevicesltd.co.uk

  • amzosecsn-jp.icu

  • builtmedia.co.uk

  • duoguang.top

  • forumken.net

  • cqivrh.cfd

  • lr-nexusark.com

  • carrirae.shop

  • jtownexclusive.africa

  • georoiddemo.online

  • lefinet.com

  • otc.rsvp

  • kitchenpharmacy.co.uk

  • bbywafz248xca4.com

  • digijockey.com

  • 9-ji.com

Targets

    • Target
      Quotation.exe
    • Size 899KB
    • SHA256 ddd9ead73e818770fe8bc81da65f863e2ed6d20a6a32c60817d3edc8c4aa38d4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookcs94ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks