Overview

overview

10

Static

static

3

a96c7253ca...ae.exe

windows7-x64

10

a96c7253ca...ae.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a96c7253cab161d289efdea709091608649deeb1423a4df65d1cd13ad28642ae.exe
  • Size 651KB
  • Sample240802-cpc1tsvbrb
  • SHA256 a96c7253cab161d289efdea709091608649deeb1423a4df65d1cd13ad28642ae
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookde94discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • de94

Decoy

  • gx899.top

  • whoistommy.info

  • vabex.shop

  • vduwum.rest

  • betbox2351.com

  • ch3kat0.online

  • kaduexpress.com

  • sibonline.shop

  • bt365918.com

  • betterlabs.app

  • denversandandgravel.net

  • webzlp.xyz

  • tdodtn263q.xyz

  • zamaninvest.com

  • vcxwpo.xyz

  • myastrolyfe.com

  • lsm8v87jnkrqcnr.buzz

  • ilregnodellecozze.com

  • auroraskynholistics.com

  • sewassist.com

Targets

    • Target
      a96c7253cab161d289efdea709091608649deeb1423a4df65d1cd13ad28642ae.exe
    • Size 651KB
    • SHA256 a96c7253cab161d289efdea709091608649deeb1423a4df65d1cd13ad28642ae
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookde94discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks