Overview

overview

10

Static

static

3

9deb8fec62...18.exe

windows7-x64

10

9deb8fec62...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9deb8fec62787f6a330618dfcb84d818
  • Size 677KB
  • Sample240215-s1ralaab7x
  • SHA256 0f83f86907255eadae1caec99da48bd60689e359e40938f12453dcb3093851ad
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookif60ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • if60

Decoy

  • dutaaksarawedar.com

  • conflicttech.com

  • growinfant.com

  • desingchiro.com

  • juicykingcrabexpress1111.com

  • christal-capital.com

  • mythicspacex.com

  • eezeecompliance.com

  • smartpro-apps.com

  • foliapaper.com

  • decor-galorec.com

  • wednesdaywinetime.com

  • ecnstore.com

  • icitycompany.com

  • kokaabrows.com

  • edwardmillerplumbing.com

  • nasiratusa.net

  • thaicafeirvine.com

  • serviceinnovation.net

  • freedigilife.com

Targets

    • Target
      9deb8fec62787f6a330618dfcb84d818
    • Size 677KB
    • SHA256 0f83f86907255eadae1caec99da48bd60689e359e40938f12453dcb3093851ad
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookif60ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks