Overview

overview

10

Static

static

5

9aeee1a70a...96.exe

windows7-x64

10

9aeee1a70a...96.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    7ad4c6133f4f75ae91bf07f65dc5f21a.bin
  • Size 672KB
  • Sample240505-bt6chade44
  • SHA256 b2879ec4327e74f9e63ad47c271d286ba64ce1fff71e52c123881f4db55a60e9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookba94ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ba94

Decoy

  • dxtra.shop

  • upfromhere-eventsdecor.com

  • blacksevenkoeln.shop

  • pcboards2024.xyz

  • posteo.lol

  • naservus.com

  • pivotance.com

  • 90ans.com

  • ebenezer-remodeling.com

  • reddragondao.com

  • gspotshop.com

  • thesiamesebetta.biz

  • rrdhq.com

  • greenislandservices.info

  • prismotrov.com

  • elaqbh.shop

  • sosenfantscovidlong.com

  • elmsolarsavings.com

  • sol-casino-2023.club

  • sharecroipper.top

Targets

    • Target
      9aeee1a70ae929e15e376532efa734d1a7dd5c0b0c814c3e620dcfe68e7baa96.exe
    • Size 1.1MB
    • SHA256 9aeee1a70ae929e15e376532efa734d1a7dd5c0b0c814c3e620dcfe68e7baa96
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookba94ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks