Overview

overview

10

Static

static

5

29c87cc979...63.exe

windows7-x64

10

29c87cc979...63.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    29c87cc9791289ada6dd99bea234651b38ce32f2099760a85d1b84819ea85f63
  • Size 1.3MB
  • Sample240510-mg764scf79
  • SHA256 29c87cc9791289ada6dd99bea234651b38ce32f2099760a85d1b84819ea85f63
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookse62ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • se62

Decoy

  • wkb41961shv.com

  • bdsxm.com

  • renovationslandscaping.info

  • qhsmgysm.com

  • fetbody.com

  • injured444.live

  • teensfeel.us

  • zi59wp1h.com

  • dfrtrucking.com

  • 16milevet.com

  • patternzi.com

  • homeinsectcontrolpros.com

  • alcosa-peru.com

  • rmicompletesolutions.co.za

  • nnhealthhk.com

  • fitversus.com

  • hgxaf155.com

  • hizlitakibin.com

  • kjhwbk.top

  • gokarpemed.com

Targets

    • Target
      29c87cc9791289ada6dd99bea234651b38ce32f2099760a85d1b84819ea85f63
    • Size 1.3MB
    • SHA256 29c87cc9791289ada6dd99bea234651b38ce32f2099760a85d1b84819ea85f63
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookse62ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks