Overview

overview

10

Static

static

3

591dac333a...a5.exe

windows7-x64

10

591dac333a...a5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    591dac333aff7739bf01a4c9d3e838a5.exe
  • Size 699KB
  • Sample240119-vxjsfsaebk
  • SHA256 0509f94b1130c86832027f9990c3f3da9a84bc00f1462e99e8ef16a806944bb4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookhe09ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • he09

Decoy

  • clhear.com

  • maythunguyen.com

  • xiongmaoaijia.com

  • kembangzadsloh.xyz

  • speedwagner.com

  • 360bedroom.com

  • campereurorg.top

  • cwxg2.site

  • mcdlibre.live

  • globigprimecompanylimited.com

  • 1707102023-stripe.com

  • xhfj5.site

  • mugiwaranousopp.xyz

  • texmasco.com

  • sc9999.net

  • lite.team

  • 8xb898.com

  • cibecuetowing.top

  • mgplatinemlak.xyz

  • southwestharborkeyword.top

Targets

    • Target
      591dac333aff7739bf01a4c9d3e838a5.exe
    • Size 699KB
    • SHA256 0509f94b1130c86832027f9990c3f3da9a84bc00f1462e99e8ef16a806944bb4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookhe09ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks