Overview

overview

10

Static

static

3

28cef10cd2...99.exe

windows7-x64

10

28cef10cd2...99.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    28cef10cd2959bbf874933daa5b5b899.exe
  • Size 551KB
  • Sample230708-ee283sdf81
  • SHA256 5eb2fdddbd470e55de54cab50d8906e00eb202714c9b0cb2fd95b4b58b3a125b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookk2l0ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • k2l0

Decoy

  • thaomocquysonla.click

  • everblue-scr.com

  • yifangwuliu.top

  • zmrwe.buzz

  • xiaodong6.xyz

  • apartmentsforrent-gb-tok.bond

  • mtproductions.xyz

  • yattaya.com

  • thetastyfoodguide.com

  • gulfcoastclubfishing.com

  • capitalrepros.com

  • sonetpl.com

  • amenallelulia.com

  • shafanavn.com

  • 1ywab.com

  • getflooringservices.today

  • quanhuipeng.com

  • tinytribecollective.com

  • mollyandpat.com

  • 280175053.xyz

Targets

    • Target
      28cef10cd2959bbf874933daa5b5b899.exe
    • Size 551KB
    • SHA256 5eb2fdddbd470e55de54cab50d8906e00eb202714c9b0cb2fd95b4b58b3a125b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookk2l0ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks