Overview

overview

10

Static

static

5

MalwareBazaar.exe

windows7-x64

10

MalwareBazaar.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    MalwareBazaar.14
  • Size 1.1MB
  • Sample240724-rmybbazfnq
  • SHA256 d2a39b14a5228cf9cbaa0535645985cccc4bf04328e4de0592483b06b623242e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookpt46discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • pt46

Decoy

  • twinportslocal.com

  • rovor.store

  • 98169.club

  • mdywl.com

  • jrd3s.rest

  • aston1717.top

  • floridawoodworkingmachinery.com

  • 17tk555t.com

  • ankitsho.shop

  • seclameh.com

  • realrecordlabel.com

  • trenchonbirmingham.com

  • af28.top

  • rtp1kenzototo.com

  • theselflovesite.com

  • promotegetpaid.info

  • strategiclogisticsagency.com

  • learneracademy.net

  • per-watch.com

  • betbox2341.com

Targets

    • Target
      MalwareBazaar.14
    • Size 1.1MB
    • SHA256 d2a39b14a5228cf9cbaa0535645985cccc4bf04328e4de0592483b06b623242e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookpt46discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks