Overview

overview

10

Static

static

3

Quote Request.exe

windows7-x64

3

Quote Request.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Quote Request.exe
  • Size 593KB
  • Sample231022-jh57csec2w
  • SHA256 ccd3d1ec6d5b5723225b7d0c6488de099b2b22c5b70bc1c521c148160f5997cc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbook5nd2ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • 5nd2

Decoy

  • soulalchemyhub.com

  • geisa24.online

  • 1c0v9.xyz

  • marcomarzadori-shop.com

  • yarn360.net

  • coding-bootcamps-57448.bond

  • kjtrhtsd.top

  • 83b52.com

  • xiaomadou8.com

  • d4rk23.com

  • abdg1.com

  • clientunlimited.com

  • 29981e.shop

  • scshuixie.fun

  • erxbet171.com

  • yiyageshafa.com

  • salju4d5.com

  • valentinpfaffenwimmer.com

  • profitecnicaingenieria.com

  • dohafintech.net

Targets

    • Target
      Quote Request.exe
    • Size 593KB
    • SHA256 ccd3d1ec6d5b5723225b7d0c6488de099b2b22c5b70bc1c521c148160f5997cc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbook5nd2ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks