Overview

overview

10

Static

static

3

8c92b39496...8b.exe

windows7-x64

3

8c92b39496...8b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4e8be6beb68d0a659e140e7111493b74247d67eb4d08a1f61da1be1d3f6aae9f

  • Size

    643KB

  • Sample

    240830-d2p2lavbpe

  • MD5

    1a032fd5277b9356950f6f914ed1caa3

  • SHA1

    86596693184fc439a4e41795ee28cf12cf361c17

  • SHA256

    4e8be6beb68d0a659e140e7111493b74247d67eb4d08a1f61da1be1d3f6aae9f

  • SHA512

    62e705d2a557c6d4f9b1c1aa655abc39ef794c4c46f4825ece01cd0a24a75da3d398f4ea02945e72ce645971fb94178ad562c47110a6779cc407cac6635f9692

  • SSDEEP

    12288:2ksLuzegsCMAIEogtkLgXBJ3MgE/SD5LOvD2ZluFpfcEiqPdvFWgI:Dspg8EoWBpMgucLOvaZluFJiqPdvFE

Score
10/10
formbookd16hdiscoveryratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d16h

Decoy

iki-graphy.online

l8z8c.vip

1709.asia

inematography-course-72246.bond

pis3noe2e.sbs

wernv.xyz

ovepepe.xyz

ama-online.world

ookmouse.fun

harkclothingdesigns.xyz

bbvvjuiqew.bond

sed-cars-93620.bond

esgateeganhe.shop

cekmeledak.info

ebulahorizon.buzz

peakers-92991.bond

essislotgoal16.top

hafi.biz

ichunyang.club

lrica.net

Targets

    • Target

      8c92b39496a1f938d9c16ad3e1a7948b48923fd028e23a422c5bf8f0b7e1138b.exe

    • Size

      689KB

    • MD5

      1965f06fb4c6e169c7014c90c5b93199

    • SHA1

      a8a949da0262c8165e52fd84276b0f299a86db2b

    • SHA256

      8c92b39496a1f938d9c16ad3e1a7948b48923fd028e23a422c5bf8f0b7e1138b

    • SHA512

      f00216c9c9b5051b432d939217dfd90ecf7e6f0373f48db018c9e9faa6b25a56db496a125a9a53ffd5660283db92d36a32671725b84652d3100d1e60d9dc2746

    • SSDEEP

      12288:z4UkfadvMq2bjiwAszlTRPipvBjxOqEEtMcLsfSbASQi8N0DjmEuv3/s0z3/rO:EUjVKmw5TZgkItMcLsfSbMqLwPb/r

    Score
    10/10
    discoveryformbookd16hratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks