Overview

overview

10

Static

static

3

9a565700a3...84.exe

windows7-x64

10

9a565700a3...84.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9a565700a3d3c7a802780c0e4ba717b082175fd33b5afc7dcfeb95905b6db784.zip
  • Size 556KB
  • Sample240402-maax2afa56
  • SHA256 9bb7a469a395f8f78d7d2a5d4b97f8b8c97f22b0189b78799865617d4d4f7520
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooko22dratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • o22d

Decoy

  • stillsfengservices.com

  • protectagainstcrime.com

  • winiboya.com

  • mindbeforemusic.com

  • giyelz1i5.sbs

  • coin8899.com

  • coolgirls.club

  • ssdcf1416aasx.world

  • heir.solutions

  • soulmatchup.xyz

  • ingenetpy.com

  • knkvdqt5g.sbs

  • vireoremedy.com

  • leopolis.rent

  • apartment-for-rent-314.space

  • theenlightenedmotherhood.com

  • zidao.cloud

  • oi7982jbacdbfssagroup.monster

  • anandasnacks.com

  • start.beer

Targets

    • Target
      9a565700a3d3c7a802780c0e4ba717b082175fd33b5afc7dcfeb95905b6db784.exe
    • Size 590KB
    • SHA256 9a565700a3d3c7a802780c0e4ba717b082175fd33b5afc7dcfeb95905b6db784
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooko22dratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks