Overview

overview

10

Static

static

3

639f7cc13e...a5.exe

windows7-x64

10

639f7cc13e...a5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    639f7cc13ef676dc11432dfb872f5ea5.exe
  • Size 610KB
  • Sample230810-vctrxsfc66
  • SHA256 9d0a05a5f2cd9f4ab18c167ee94b33669992d74140a0d334e84eb1b2efd4e313
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookoy30ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • oy30

Decoy

  • rfc234.top

  • danielcavalari.com

  • elperegrinocabo.com

  • aryor.info

  • surelistening.com

  • premium-numero-telf.buzz

  • orlynyml.click

  • tennislovers-ro.com

  • holdmytracker.com

  • eewapay.com

  • jaimesinstallglass.com

  • damactrade.net

  • swapspecialities.com

  • perfumesrffd.today

  • salesfactory.pro

  • supportive-solutions.com

  • naiol.com

  • khoyr.com

  • kalendeargpt44.com

  • web-tech-spb.store

Targets

    • Target
      639f7cc13ef676dc11432dfb872f5ea5.exe
    • Size 610KB
    • SHA256 9d0a05a5f2cd9f4ab18c167ee94b33669992d74140a0d334e84eb1b2efd4e313
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookoy30ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks