Overview

overview

10

Static

static

3

06ec32deab...34.exe

windows7-x64

10

06ec32deab...34.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    06ec32deab3a42035103eebf1b7f2634.exe
  • Size 577KB
  • Sample231106-kpv6eabf86
  • SHA256 4e0083ec0b7eac1f6a517e47fc77f8aa0fe7229dc4f8ad8dc42c170ebc2dd2c1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooko5guratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • o5gu

Decoy

  • jonathanvuportfolio.website

  • moneyboost.net

  • imikecutyou.com

  • toollessassembling.com

  • keoinfra.com

  • mackenziejamesphoto.com

  • zenovaa.com

  • ngmnetwork.com

  • odropoficial.com

  • huyangli.company

  • ganjajuice.info

  • promptmechanic.xyz

  • crispyjoy.com

  • dinevintageshirts.com

  • heyxop.online

  • hopefinancialmarketingph.com

  • weeklyvolcano.app

  • consultoriopmn.com

  • seetheratequote.com

  • ftds77.com

Targets

    • Target
      06ec32deab3a42035103eebf1b7f2634.exe
    • Size 577KB
    • SHA256 4e0083ec0b7eac1f6a517e47fc77f8aa0fe7229dc4f8ad8dc42c170ebc2dd2c1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooko5guratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks