Overview

overview

10

Static

static

1

iU3WGoA77BdiFdA.exe

windows7-x64

10

iU3WGoA77BdiFdA.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    iU3WGoA77BdiFdA.exe
  • Size 758KB
  • Sample240318-kapp3scc24
  • SHA256 e54350487bda76835619ccc44ff79db38db5183f544efbf33159cfd707bcdb75
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookns03ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ns03

Decoy

  • dipity.tech

  • agathis.fun

  • ekaterinai.store

  • elizabethsbookshelf.com

  • smilesustainably.com

  • tapeworm.xyz

  • beatricesswarthout.xyz

  • nsrpackersandpackers.in

  • yedxec.xyz

  • gildedbeautyaesthitics.com

  • hanibalbechar.com

  • fichaphuman.net

  • adilosk.shop

  • geezaran.com

  • ventasemail.com

  • phonecasesdirect.store

  • rctjuc.shop

  • sukimossmanagement.com

  • caller-id.today

  • kft07.vip

Targets

    • Target
      iU3WGoA77BdiFdA.exe
    • Size 758KB
    • SHA256 e54350487bda76835619ccc44ff79db38db5183f544efbf33159cfd707bcdb75
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookns03ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks