Overview

overview

10

Static

static

3

b5027bab17...61.exe

windows7-x64

10

b5027bab17...61.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b5027bab17fb5aa21f00bf3ba4528661.exe
  • Size 748KB
  • Sample230808-jj9aeabc67
  • SHA256 e4b8b19c8c8fd39ae06ba2ec632970e7fe16f78ca1f91582461de5da1403a4ed
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookoy30ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • oy30

Decoy

  • rfc234.top

  • danielcavalari.com

  • elperegrinocabo.com

  • aryor.info

  • surelistening.com

  • premium-numero-telf.buzz

  • orlynyml.click

  • tennislovers-ro.com

  • holdmytracker.com

  • eewapay.com

  • jaimesinstallglass.com

  • damactrade.net

  • swapspecialities.com

  • perfumesrffd.today

  • salesfactory.pro

  • supportive-solutions.com

  • naiol.com

  • khoyr.com

  • kalendeargpt44.com

  • web-tech-spb.store

Targets

    • Target
      b5027bab17fb5aa21f00bf3ba4528661.exe
    • Size 748KB
    • SHA256 e4b8b19c8c8fd39ae06ba2ec632970e7fe16f78ca1f91582461de5da1403a4ed
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookoy30ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks