Overview

overview

10

Static

static

5

Salary Increase.exe

windows7-x64

10

Salary Increase.exe

windows10-2004-x64

3

Resubmissions

22/07/2024, 00:12

240722-ahfr2avamn10

22/07/2024, 00:12

240722-ag7t5avalp5

21/07/2024, 23:42

240721-3pzspstann10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Salary Increase.exe
  • Size 1.0MB
  • Sample240722-ahfr2avamn
  • SHA256 55911205edcecf1a4337052e070334ad0dfb5b651cb980122a963b811aeda078
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookty31ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ty31

Decoy

  • jejakunik.com

  • inb319.com

  • jifsjn.buzz

  • gkyukon.site

  • 43443.cfd

  • cogil69id.com

  • oeaog.com

  • lpgatm.com

  • mymarketsales.com

  • tomclk.icu

  • 404417.online

  • nysconstruction.com

  • ourwisequote.com

  • ahsanadvisory.com

  • ottawaherps.com

  • forevermust.com

  • apartments-for-rent-47679.bond

  • kdasjijaksdd.icu

  • buthaynah.com

  • manggungjayakanopi.com

Targets

    • Target
      Salary Increase.exe
    • Size 1.0MB
    • SHA256 55911205edcecf1a4337052e070334ad0dfb5b651cb980122a963b811aeda078
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookty31ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks