Overview

overview

10

Static

static

5

PO-2300067254.exe

windows10-2004-x64

10

PO-2300067254.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9363b75f73d9f2dd201ddd3a353990bd92c9432273acbefe2a74a1f2efef3c6a.rar
  • Size 631KB
  • Sample240409-lr59tsfc3z
  • SHA256 9363b75f73d9f2dd201ddd3a353990bd92c9432273acbefe2a74a1f2efef3c6a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookki21ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ki21

Decoy

  • nikonz9.com

  • piazzadelcondominio.cloud

  • stylistandcojewelry.com

  • watchingmovie79.store

  • dontpanic.solutions

  • cy888.xyz

  • pediatricdentalassoc.com

  • mg2selot7.us

  • gotireja.com

  • valdez.cloud

  • burgoontowing.top

  • void89.site

  • yoicok.online

  • rjinfo.xyz

  • omgwin7.online

  • pineislandhouseforsale.com

  • squidgamehalf.com

  • cpphgroup.com

  • kitahoki.pro

  • greenfieldnetworkinvest.com

Targets

    • Target
      PO-2300067254.exe
    • Size 1.1MB
    • SHA256 f89d3476a8435494b20b91d72b8092100550d7fcf5dddb16931d0bede90676d3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookki21ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks