Overview

overview

10

Static

static

5

swift copy.exe

windows7-x64

10

swift copy.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    10072024_0105_09072024_Ticket Receipt and Fine.zip
  • Size 629KB
  • Sample240710-bfg3raydph
  • SHA256 1859fec327baa69a10975e1884e4a70731b060e12aa8aca81dfe43e9e209f1df
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookpt46ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • pt46

Decoy

  • twinportslocal.com

  • rovor.store

  • 98169.club

  • mdywl.com

  • jrd3s.rest

  • aston1717.top

  • floridawoodworkingmachinery.com

  • 17tk555t.com

  • ankitsho.shop

  • seclameh.com

  • realrecordlabel.com

  • trenchonbirmingham.com

  • af28.top

  • rtp1kenzototo.com

  • theselflovesite.com

  • promotegetpaid.info

  • strategiclogisticsagency.com

  • learneracademy.net

  • per-watch.com

  • betbox2341.com

Targets

    • Target
      swift copy.exe
    • Size 1.0MB
    • SHA256 cb94f7e2d32391ffa226f27e39543a099f2867c9cc7602fb964b4358132b6a50
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookpt46ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks