Overview

overview

10

Static

static

3

MalwareBazaar.exe

windows7-x64

10

MalwareBazaar.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    MalwareBazaar.18
  • Size 653KB
  • Sample240801-kclffa1eln
  • SHA256 a8af52f378b0d8cc71513411d4af5c383147c03064981084c63125b3f57b7f6a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookde94discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • de94

Decoy

  • way2future.net

  • worldnewsdailys.online

  • rendamaisbr.com

  • s485.icu

  • vcxwpo.xyz

  • imagivilleartists.com

  • herbatyorganics.com

  • xn--80ado1abokv5d.xn--p1acf

  • invigoratewell.com

  • especialistaleitura.online

  • pkrstg.com

  • performacaretechnical.com

  • dreamgame55.net

  • hkitgugx.xyz

  • istanlikbilgiler.click

  • slotter99j.vip

  • exploringtheoutdoors.net

  • triberoots.com

  • energiaslotsbet.com

  • dkforcm.com

Targets

    • Target
      MalwareBazaar.18
    • Size 653KB
    • SHA256 a8af52f378b0d8cc71513411d4af5c383147c03064981084c63125b3f57b7f6a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookde94discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks