Overview

overview

10

Static

static

3

mQY9ka5sW6hv2Ri.exe

windows7-x64

10

mQY9ka5sW6hv2Ri.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    mQY9ka5sW6hv2Ri.exe
  • Size 584KB
  • Sample240701-x4czlayeqq
  • SHA256 a5a3067e6a3c4e957152655df5c68ce4db77f8308feff43c53e7535031033be5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookdy13ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • dy13

Decoy

  • manga-house.com

  • kjsdhklssk51.xyz

  • b0ba138.xyz

  • bt365033.com

  • ccbsinc.net

  • mrwine.xyz

  • nrxkrd527o.xyz

  • hoshi.social

  • 1912ai.com

  • serco2020.com

  • byfchfyr.xyz

  • imuschestvostorgov.online

  • austinheafey.com

  • mrdfa.club

  • 883106.photos

  • profitablefxmarkets.com

  • taini00.net

  • brye.top

  • ginsm.com

  • sportglid.com

Targets

    • Target
      mQY9ka5sW6hv2Ri.exe
    • Size 584KB
    • SHA256 a5a3067e6a3c4e957152655df5c68ce4db77f8308feff43c53e7535031033be5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookdy13ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks