Overview

overview

10

Static

static

5

PO2024.exe

windows7-x64

10

PO2024.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c3003e82f1e4508bb923a29c746e4d865d9abe3ba0fb4da34c727fb4c53e9898
  • Size 636KB
  • Sample240827-chk3vsxcrh
  • SHA256 c3003e82f1e4508bb923a29c746e4d865d9abe3ba0fb4da34c727fb4c53e9898
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookph01discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ph01

Decoy

  • 23888.sbs

  • zvcj.sbs

  • raitpourtrait.net

  • ibraryfarmclub.online

  • omputercourses123.live

  • j88.doctor

  • atsue-color.click

  • epitalrentgrup.online

  • rvvpn.lol

  • i-signals.tech

  • cr-phoenix.best

  • frican-safari.online

  • c-games.zone

  • oardetest.online

  • f4md.shop

  • uke-saaac.buzz

  • arze.dev

  • nvestment-services-49610.bond

  • izatrip.sbs

  • ameron-paaaa.buzz

Targets

    • Target
      PO2024.exe
    • Size 1.0MB
    • SHA256 8909a2b3749cb8ce0a53d100d45e034c66f5bf69684bbb6392f9e305433f7f40
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookph01discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks