Overview

overview

10

Static

static

3

f4b495bc96...4c.exe

windows7-x64

10

f4b495bc96...4c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f4b495bc964bbf91246a27e1e0bb242c0e7cb80729a97ae8bd8be53c3c91ef4c.exe
  • Size 723KB
  • Sample231206-ryj8tsfc68
  • SHA256 f4b495bc964bbf91246a27e1e0bb242c0e7cb80729a97ae8bd8be53c3c91ef4c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookbtrdratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • btrd

Decoy

  • toulouse.gold

  • launchyouglobal.com

  • margarita-services.com

  • dasnail.club

  • casa-hilo.com

  • hardscapesofflorida.com

  • thepositivitypulse.com

  • kkmyanev.cfd

  • love6ace22.top

  • castorcruise.com

  • chch6.com

  • h59f07jy.cfd

  • saatvikteerthyatra.com

  • fxsecuretrading-option.com

  • mostbet-k1o.click

  • 36-m.beauty

  • ko-or-a-news.com

  • eurekatextile.com

  • gynlkj.com

  • deepsouthcraftsman.com

Targets

    • Target
      f4b495bc964bbf91246a27e1e0bb242c0e7cb80729a97ae8bd8be53c3c91ef4c.exe
    • Size 723KB
    • SHA256 f4b495bc964bbf91246a27e1e0bb242c0e7cb80729a97ae8bd8be53c3c91ef4c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookbtrdratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks