Overview

overview

10

Static

static

5

QUOTATION ...RY.exe

windows7-x64

10

QUOTATION ...RY.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    QUOTATION FOR ATTACHED INQUIRY.zip
  • Size 712KB
  • Sample240808-cmpxlsyank
  • SHA256 514a38272f6fd9372f739709eb5c11c5260ddf71b7b600ba4458763f1e44c825
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookbi05discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • bi05

Decoy

  • ollow-the-bit.online

  • aopho.autos

  • 14ra567dp.autos

  • 48651301.top

  • ussian-dating-54714.bond

  • sychology-degree-80838.bond

  • lytracker.xyz

  • strology-forest.sbs

  • swjbcl3.top

  • ridgenexttechnologies.partners

  • lroy.sbs

  • kyscreen.vip

  • anhit.live

  • uckyheart.xyz

  • orddserials.online

  • hetune.shop

  • nherited-traits-ant.bond

  • stanaslot-1.xyz

  • sychologist-therapy-36914.bond

  • iandramonami.net

Targets

    • Target
      QUOTATION FOR ATTACHED INQUIRY.exe
    • Size 1.1MB
    • SHA256 886c7ebfad029160c6aab6aa288765e5488abb140a1c99b795951de91e370157
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookbi05discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks