Overview

overview

10

Static

static

5

shipping doc.exe

windows7-x64

10

shipping doc.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    shipping doc.exe
  • Size 1.1MB
  • Sample240503-navswadb4s
  • SHA256 9aeee1a70ae929e15e376532efa734d1a7dd5c0b0c814c3e620dcfe68e7baa96
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookba94ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ba94

Decoy

  • dxtra.shop

  • upfromhere-eventsdecor.com

  • blacksevenkoeln.shop

  • pcboards2024.xyz

  • posteo.lol

  • naservus.com

  • pivotance.com

  • 90ans.com

  • ebenezer-remodeling.com

  • reddragondao.com

  • gspotshop.com

  • thesiamesebetta.biz

  • rrdhq.com

  • greenislandservices.info

  • prismotrov.com

  • elaqbh.shop

  • sosenfantscovidlong.com

  • elmsolarsavings.com

  • sol-casino-2023.club

  • sharecroipper.top

Targets

    • Target
      shipping doc.exe
    • Size 1.1MB
    • SHA256 9aeee1a70ae929e15e376532efa734d1a7dd5c0b0c814c3e620dcfe68e7baa96
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookba94ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks