Overview

overview

10

Static

static

3

08e48f5e04...94.exe

windows7-x64

10

08e48f5e04...94.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    08e48f5e04d2b752699bd6315681e494
  • Size 695KB
  • Sample231230-a2wbtsdfe2
  • SHA256 e32906edfa8d988075e6d062f5ea60f7550595eeef8f1d2177d387dc51f67a5c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookif60ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • if60

Decoy

  • dutaaksarawedar.com

  • conflicttech.com

  • growinfant.com

  • desingchiro.com

  • juicykingcrabexpress1111.com

  • christal-capital.com

  • mythicspacex.com

  • eezeecompliance.com

  • smartpro-apps.com

  • foliapaper.com

  • decor-galorec.com

  • wednesdaywinetime.com

  • ecnstore.com

  • icitycompany.com

  • kokaabrows.com

  • edwardmillerplumbing.com

  • nasiratusa.net

  • thaicafeirvine.com

  • serviceinnovation.net

  • freedigilife.com

Targets

    • Target
      08e48f5e04d2b752699bd6315681e494
    • Size 695KB
    • SHA256 e32906edfa8d988075e6d062f5ea60f7550595eeef8f1d2177d387dc51f67a5c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookif60ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks