Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    file.exe
  • Size 337KB
  • Sample231121-rhapfsff8s
  • SHA256 4169bc8ef83d44e5cd72de2f88c40602f7840d578e1ec0bbdd9b2a874bb75c4c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookt2tiratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • t2ti

Decoy

  • j6y.lat

  • kindlekidz.com

  • studio352events.com

  • merelweb.com

  • 6061k.vip

  • iuk242.com

  • tiltedjava.net

  • importmotorshickory.com

  • codinnotech.com

  • foodapartcupboardscript.click

  • donovanmanuel.store

  • michealwilshire.online

  • clawenterprises.net

  • spacecargo.net

  • duadqps.com

  • allamericanshuttlellc.com

  • shucaimh.com

  • qivovrj.com

  • infynite1.net

  • albertcolet.com

Targets

    • Target
      file.exe
    • Size 337KB
    • SHA256 4169bc8ef83d44e5cd72de2f88c40602f7840d578e1ec0bbdd9b2a874bb75c4c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookt2tiratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks