Overview

overview

10

Static

static

3

Dokument-99373.exe

windows7-x64

10

Dokument-99373.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Dokument-99373.exe
  • Size 585KB
  • Sample240405-kcemwsfg88
  • SHA256 1711d935991cb37bd208dec08aefb47cf049baa4aa465d3188feccd8d330e72d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookhe24ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • he24

Decoy

  • shopnet20.store

  • vita-white.com

  • iamdaveta.com

  • rohansanger.com

  • vaznenovosti.com

  • locatednorth.com

  • zhushuoclass.com

  • shyrewoodstudios.com

  • moriichi-yoh.work

  • nottinghamlotto.com

  • shufflecasinos.com

  • vdengenharia.com

  • aldawater.com

  • rangolicontest.com

  • akkkxs.com

  • bjiarts.com

  • 7thairlimited.com

  • sabrinabracero.com

  • xn--jp168-n51bb.com

  • combqjldaxbhkk.vip

Targets

    • Target
      Dokument-99373.exe
    • Size 585KB
    • SHA256 1711d935991cb37bd208dec08aefb47cf049baa4aa465d3188feccd8d330e72d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookhe24ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks