Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

REF_10113127.rtf

windows7-x64

10

REF_10113127.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    REF_10113127.doc

  • Size

    189KB

  • Sample

    231102-ym4lnaef41

  • MD5

    856f8fd3fd99c87c15057baedea5abda

  • SHA1

    5608ef791ef83c243949549099a4435c1c728e44

  • SHA256

    091c56138984569435a05540b0fc6d9bcaae31a5a2a7adaf3f91e2614a7cfe42

  • SHA512

    2a434703de11f71f07e2bd094e316ed7ecac18a156b0adc58249513990f2c238b7418b762b74ef4677a48953ffd6030f3a69ba9a7b9309b9166a9a7187c59197

  • SSDEEP

    768:YwAbZSibMX9gRWjQPWuoPAAslwcqEyiHM/j6s:YwAlRLWuoPAAGMEyt76s

Score
10/10
formbookbtrdratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

btrd

Decoy

toulouse.gold

launchyouglobal.com

margarita-services.com

dasnail.club

casa-hilo.com

hardscapesofflorida.com

thepositivitypulse.com

kkmyanev.cfd

love6ace22.top

castorcruise.com

chch6.com

h59f07jy.cfd

saatvikteerthyatra.com

fxsecuretrading-option.com

mostbet-k1o.click

36-m.beauty

ko-or-a-news.com

eurekatextile.com

gynlkj.com

deepsouthcraftsman.com

Targets

    • Target

      REF_10113127.doc

    • Size

      189KB

    • MD5

      856f8fd3fd99c87c15057baedea5abda

    • SHA1

      5608ef791ef83c243949549099a4435c1c728e44

    • SHA256

      091c56138984569435a05540b0fc6d9bcaae31a5a2a7adaf3f91e2614a7cfe42

    • SHA512

      2a434703de11f71f07e2bd094e316ed7ecac18a156b0adc58249513990f2c238b7418b762b74ef4677a48953ffd6030f3a69ba9a7b9309b9166a9a7187c59197

    • SSDEEP

      768:YwAbZSibMX9gRWjQPWuoPAAslwcqEyiHM/j6s:YwAlRLWuoPAAGMEyt76s

    Score
    10/10
    formbookbtrdratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks