Overview

overview

10

Static

static

3

scan.tt-pd...Sf.exe

windows7-x64

10

scan.tt-pd...Sf.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    scan.tt-pdf.iso

  • Size

    652KB

  • Sample

    230815-hxesaahc83

  • MD5

    997e8ab5695a7baa154d17426abce9eb

  • SHA1

    55a8884b50dcd007ce5e4a84c7b9ab13901574a2

  • SHA256

    f2f85fa1743b7a06367166912a274cacfff5f43fb59b358ef5913e3dd5d7a0a9

  • SHA512

    f05ca5aba7e8b2ef596762dc0a67a2a82b2eea906c09f1ae1260f7e3a0c2e51adf3a5422a783a44d026d5abb3d7908795b3247c9c1280fd35e7e5c8bc68c400f

  • SSDEEP

    12288:rr4lrrr/zYPeL3bhmL8NnTl/EOnOzfAq3zStUunsB:rr4lXr/zieL3boQRlNn3q3ujns

Score
10/10
formbookd6dtratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d6dt

Decoy

curenveda.com

mavilitur.xyz

airdropfisher.com

jxwqeumw.click

solepowertool.com

quickmartltd.com

postbh.com

aerialcarried.click

teamabr-rfa.com

jeagma9k.click

aquaafiafoodsafety.com

dangtutu.com

lahfhg.com

patricia-lee.com

nextgencoders.tech

scercommerce.online

crates.surf

casamorganagelatos.com

dwynet.com

3genenterprisesllc.com

Targets

    • Target

      scan.tt-pdf/vgwR4TopGfezKSf.exe

    • Size

      587KB

    • MD5

      28add1243c433986dbb73ef4e6763fa1

    • SHA1

      eb5c172e07f5f8b7e30417ee8547a58b05996756

    • SHA256

      73cb9c68b47d45884c4cbdb18d45a63a4d67a1f22ab8cb2a6ec92423cd77948d

    • SHA512

      af35f5f3540b3110602222f917ea9fa76cf743573826d3e1a89472ed7623d88be97cd7c9f4c3d9c8b38d0ff7d2bed2c708809a1cda5de93990389e3bd6970542

    • SSDEEP

      12288:3r4lrrr/zYPeL3bhmL8NnTl/EOnOzfAq3zStUunsB:3r4lXr/zieL3boQRlNn3q3ujns

    Score
    10/10
    formbookd6dtratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks