Overview

overview

10

Static

static

3

6lRQ0ZEQF6xtTAc.exe

windows7-x64

10

6lRQ0ZEQF6xtTAc.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6lRQ0ZEQF6xtTAc.exe
  • Size 775KB
  • Sample231205-vewpasdb89
  • SHA256 cc3e1fee438ef0fe104afcc8ac66f930074302f67f1b99995b2d526575ddc098
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookuh23ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • uh23

Decoy

  • hanaleikeyword.top

  • fai.ovh

  • jan8.site

  • golcondatowing.top

  • clearchoiceafh.net

  • qinglvzhuang8.com

  • luxurywatches.cat

  • katoonishop.com

  • kw2jm9er.shop

  • prodctionlaser.com

  • teachertransitionjobboard.com

  • qzlr6.site

  • kabir.tech

  • hnxuefengyuan.com

  • abc386.site

  • ra-myportfolio.com

  • bowanghg.com

  • disoklahoma.com

  • jordenshoots.com

  • imobje.space

Targets

    • Target
      6lRQ0ZEQF6xtTAc.exe
    • Size 775KB
    • SHA256 cc3e1fee438ef0fe104afcc8ac66f930074302f67f1b99995b2d526575ddc098
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookuh23ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks