Overview

overview

10

Static

static

3

fc8b3a3005...a8.exe

windows7-x64

10

fc8b3a3005...a8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    fc8b3a3005cdc80ce19af33a57010fa8.exe
  • Size 569KB
  • Sample231026-jd367sed64
  • SHA256 66e461f8245be149d5a3826d29c170d5960ade477be127c0fe2bc315e26067a3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbook4hc5ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • 4hc5

Decoy

  • amandaastburyillustration.com

  • 7141999.com

  • showshoe.info

  • sagemarlin.com

  • lithuaniandreamtime.com

  • therenixgroupllc.com

  • avalialooks.shop

  • vurporn.com

  • lemmy.systems

  • 2816goldfinch.com

  • pacersun.com

  • checktrace.com

  • loadtransfer.site

  • matsuri-jujutsukaisen.com

  • iontrapper.science

  • 5108010.com

  • beidixi.com

  • 21305599.com

  • peakvitality.fitness

  • osisfeelingfee.com

Targets

    • Target
      fc8b3a3005cdc80ce19af33a57010fa8.exe
    • Size 569KB
    • SHA256 66e461f8245be149d5a3826d29c170d5960ade477be127c0fe2bc315e26067a3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbook4hc5ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks