Overview

overview

10

Static

static

3

32b66f4634...c5.exe

windows7-x64

10

32b66f4634...c5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    32b66f4634f5c466bc1b4fa61331fbc5.exe
  • Size 690KB
  • Sample230810-vct3paha5s
  • SHA256 eb3bdf2cff8b5de8c911726f07eed2aa77a39ae01b21c0dd33aeab333a2be512
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookoy30ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • oy30

Decoy

  • rfc234.top

  • danielcavalari.com

  • elperegrinocabo.com

  • aryor.info

  • surelistening.com

  • premium-numero-telf.buzz

  • orlynyml.click

  • tennislovers-ro.com

  • holdmytracker.com

  • eewapay.com

  • jaimesinstallglass.com

  • damactrade.net

  • swapspecialities.com

  • perfumesrffd.today

  • salesfactory.pro

  • supportive-solutions.com

  • naiol.com

  • khoyr.com

  • kalendeargpt44.com

  • web-tech-spb.store

Targets

    • Target
      32b66f4634f5c466bc1b4fa61331fbc5.exe
    • Size 690KB
    • SHA256 eb3bdf2cff8b5de8c911726f07eed2aa77a39ae01b21c0dd33aeab333a2be512
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookoy30ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks