Overview

overview

10

Static

static

3

8964e3e368...0c.exe

windows7-x64

10

8964e3e368...0c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8964e3e3686d40251bb299d4b6212c0c.exe
  • Size 597KB
  • Sample230808-jj9aeabc65
  • SHA256 19f3d92b528afa72bfa9cd1f4b89b0cfc63b5cf0fef8d292ec957d853fe3b143
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookoy30ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • oy30

Decoy

  • rfc234.top

  • danielcavalari.com

  • elperegrinocabo.com

  • aryor.info

  • surelistening.com

  • premium-numero-telf.buzz

  • orlynyml.click

  • tennislovers-ro.com

  • holdmytracker.com

  • eewapay.com

  • jaimesinstallglass.com

  • damactrade.net

  • swapspecialities.com

  • perfumesrffd.today

  • salesfactory.pro

  • supportive-solutions.com

  • naiol.com

  • khoyr.com

  • kalendeargpt44.com

  • web-tech-spb.store

Targets

    • Target
      8964e3e3686d40251bb299d4b6212c0c.exe
    • Size 597KB
    • SHA256 19f3d92b528afa72bfa9cd1f4b89b0cfc63b5cf0fef8d292ec957d853fe3b143
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookoy30ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks