Overview

overview

10

Static

static

1

4UWmsYiIC0tdIFk.exe

windows7-x64

10

4UWmsYiIC0tdIFk.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4UWmsYiIC0tdIFk.exe

  • Size

    639KB

  • Sample

    240321-q8wh6see6t

  • MD5

    c53f831c0cfef4921d4236c6435a0481

  • SHA1

    961318099fa7615e9cf70cd87508df982cb13d97

  • SHA256

    4c60c35f29e69092f5e26e18d43f332f00f33be5006dfb0f9e8cc7327ec6db92

  • SHA512

    c4b45588aa914d3f11c1c9b5225bf9f47fb41dc06cc6572fc9e7666d74b60d4b9a0160c1f46fbd9841ce493b6ed1e8a864ae4459da9397ac8d2908dc98c20fbf

  • SSDEEP

    12288:10KoFwl0ECedQwZTAO8zfkWdebsqC5oAawLOfk5ukR:+KoU0ECepZcOl9sqCZabfs

Score
10/10
formbookns03ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ns03

Decoy

dipity.tech

agathis.fun

ekaterinai.store

elizabethsbookshelf.com

smilesustainably.com

tapeworm.xyz

beatricesswarthout.xyz

nsrpackersandpackers.in

yedxec.xyz

gildedbeautyaesthitics.com

hanibalbechar.com

fichaphuman.net

adilosk.shop

geezaran.com

ventasemail.com

phonecasesdirect.store

rctjuc.shop

sukimossmanagement.com

caller-id.today

kft07.vip

Targets

    • Target

      4UWmsYiIC0tdIFk.exe

    • Size

      639KB

    • MD5

      c53f831c0cfef4921d4236c6435a0481

    • SHA1

      961318099fa7615e9cf70cd87508df982cb13d97

    • SHA256

      4c60c35f29e69092f5e26e18d43f332f00f33be5006dfb0f9e8cc7327ec6db92

    • SHA512

      c4b45588aa914d3f11c1c9b5225bf9f47fb41dc06cc6572fc9e7666d74b60d4b9a0160c1f46fbd9841ce493b6ed1e8a864ae4459da9397ac8d2908dc98c20fbf

    • SSDEEP

      12288:10KoFwl0ECedQwZTAO8zfkWdebsqC5oAawLOfk5ukR:+KoU0ECepZcOl9sqCZabfs

    Score
    10/10
    formbookns03ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks