Overview

overview

10

Static

static

3

z14POO230487PDF.exe

windows7-x64

10

z14POO230487PDF.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    z14POO230487PDF.exe
  • Size 609KB
  • Sample240214-rhvdvscg7x
  • SHA256 4b7e7f50f5a8101616a2d09fbff3a3d9c3c3b3b0dc2ded2a52b6540e7ec3a558
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookgy14ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • gy14

Decoy

  • mavbam.com

  • theanhedonia.com

  • budgetnurseries.com

  • buflitr.com

  • alqamarhotel.com

  • 2660348.top

  • 123bu6.shop

  • v72999.com

  • yzyz841.xyz

  • 247fracing.com

  • naples.beauty

  • twinklethrive.com

  • loscaseros.com

  • creditspisatylegko.site

  • sgyy3ej2dgwesb5.com

  • ufocafe.net

  • techn9nehollywoodundead.com

  • truedatalab.com

  • alterdpxlmarketing.com

  • harborspringsfire.com

Targets

    • Target
      z14POO230487PDF.exe
    • Size 609KB
    • SHA256 4b7e7f50f5a8101616a2d09fbff3a3d9c3c3b3b0dc2ded2a52b6540e7ec3a558
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookgy14ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks