Overview

overview

10

Static

static

1

bnY2j1hTDlb4vxF.exe

windows7-x64

10

bnY2j1hTDlb4vxF.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PO.r01
  • Size 563KB
  • Sample240402-klzdnace74
  • SHA256 8e0cab6e15c8ecf53d170b396a5cdb6db74f1a8cc5bfd408ef5d480f25fa358c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookns03ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ns03

Decoy

  • dipity.tech

  • agathis.fun

  • ekaterinai.store

  • elizabethsbookshelf.com

  • smilesustainably.com

  • tapeworm.xyz

  • beatricesswarthout.xyz

  • nsrpackersandpackers.in

  • yedxec.xyz

  • gildedbeautyaesthitics.com

  • hanibalbechar.com

  • fichaphuman.net

  • adilosk.shop

  • geezaran.com

  • ventasemail.com

  • phonecasesdirect.store

  • rctjuc.shop

  • sukimossmanagement.com

  • caller-id.today

  • kft07.vip

Targets

    • Target
      bnY2j1hTDlb4vxF.exe
    • Size 610KB
    • SHA256 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookns03ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks