Overview

overview

10

Static

static

3

PO8687.exe

windows7-x64

10

PO8687.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8545816561e1711c0cb155440ef3b97384ed612afd78e8b8a854468cc38ab4a7
  • Size 606KB
  • Sample231023-qs6dfaah49
  • SHA256 8545816561e1711c0cb155440ef3b97384ed612afd78e8b8a854468cc38ab4a7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookro12ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ro12

Decoy

  • start399.com

  • decyfincoin.com

  • binguozhijiaok.com

  • one45.vip

  • 55dy5s.top

  • regmt.pro

  • 2ahxgaafifl.com

  • xn--6rtp2flvfc2h.com

  • justinmburns.com

  • los3.online

  • fleshaaikensdivinegiven7llc.com

  • servicedelv.services

  • apexcaryhomesforsale.com

  • shuraop.xyz

  • sagetotal.com

  • gratitude-et-compagnie.com

  • riderarea.com

  • digitalserviceact.online

  • contentbyc.com

  • agenda-digital-planner.com

Targets

    • Target
      PO8687.exe
    • Size 761KB
    • SHA256 1d18b8139377bf5246b24fd11e4386312cc4ab3e652ab9df534068ac96755394
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookro12ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks