Overview

overview

10

Static

static

1

12c7ec6f04...e4.exe

windows7-x64

9

12c7ec6f04...e4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe
  • Size 610KB
  • Sample240403-bf1j4abb2x
  • SHA256 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookns03ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ns03

Decoy

  • dipity.tech

  • agathis.fun

  • ekaterinai.store

  • elizabethsbookshelf.com

  • smilesustainably.com

  • tapeworm.xyz

  • beatricesswarthout.xyz

  • nsrpackersandpackers.in

  • yedxec.xyz

  • gildedbeautyaesthitics.com

  • hanibalbechar.com

  • fichaphuman.net

  • adilosk.shop

  • geezaran.com

  • ventasemail.com

  • phonecasesdirect.store

  • rctjuc.shop

  • sukimossmanagement.com

  • caller-id.today

  • kft07.vip

Targets

    • Target
      12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4.exe
    • Size 610KB
    • SHA256 12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookns03ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Detects executables packed with SmartAssembly

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks