Overview

overview

10

Static

static

3

z1Emir.exe

windows7-x64

1

z1Emir.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    z1Emir.exe
  • Size 833KB
  • Sample230724-nhpltsda7x
  • SHA256 95c058c714f6b443f68eedc24f78b9b5b834b4e4d77dbc20666684bc6d2e321d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookp1a4ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • p1a4

Decoy

  • kingdiscoverkenya.com

  • bystander.news

  • soul2be.academy

  • rivistangelo.com

  • newproducthat.online

  • menstruationunlocked.com

  • acmepilot.site

  • onlinebuydogbeds.website

  • energysubstance.com

  • sltn188.com

  • speedoenperu.com

  • getkani.com

  • digitroncomputeracademy.com

  • homegrass.info

  • escrimax.com

  • 3393t.vip

  • hhjjc.com

  • 188judi.xyz

  • overhired.com

  • ingresaseeguro.com

Targets

    • Target
      z1Emir.exe
    • Size 833KB
    • SHA256 95c058c714f6b443f68eedc24f78b9b5b834b4e4d77dbc20666684bc6d2e321d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookp1a4ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks