Overview

overview

10

Static

static

5

Etisalat S...ay.exe

windows7-x64

10

Etisalat S...ay.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Etisalat Summary Bill for the Month of May.exe
  • Size 1.0MB
  • Sample240603-st3eaabh94
  • SHA256 bcc5a9772d5c0d2a0db971eff31f5a0e6feccdd6cb8defccbea6f00b5967cf38
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookss63ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ss63

Decoy

  • catpig.xyz

  • chatladyanzensei7.site

  • onewayonepaydroptaxi.com

  • bima188.lol

  • wealth-km.online

  • seepao27200.top

  • 6c958u9.lol

  • fbyu57ytsd.shop

  • baranetentegre.com

  • webaichimie.com

  • h3k38q2.lol

  • abicomsrl.com

  • 338kp.vip

  • rescuecube.com

  • bubatz-t.com

  • psgluxuryapartments.com

  • goodfellowlawfirm.com

  • bais141.com

  • imingchu.com

  • ekzeanjfolzaks.top

Targets

    • Target
      Etisalat Summary Bill for the Month of May.exe
    • Size 1.0MB
    • SHA256 bcc5a9772d5c0d2a0db971eff31f5a0e6feccdd6cb8defccbea6f00b5967cf38
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookss63ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks