Overview

overview

10

Static

static

5

EDG9502024072.exe

windows7-x64

10

EDG9502024072.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    EDG9502024072.exe
  • Size 1.0MB
  • Sample240830-ql79fsxcnp
  • SHA256 7d58c8bd03c166d6a74bcec471538b4803d1ca9aa9d32f5a5286dd5aafea62ce
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookbi05discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • bi05

Decoy

  • ollow-the-bit.online

  • aopho.autos

  • 14ra567dp.autos

  • 48651301.top

  • ussian-dating-54714.bond

  • sychology-degree-80838.bond

  • lytracker.xyz

  • strology-forest.sbs

  • swjbcl3.top

  • ridgenexttechnologies.partners

  • lroy.sbs

  • kyscreen.vip

  • anhit.live

  • uckyheart.xyz

  • orddserials.online

  • hetune.shop

  • nherited-traits-ant.bond

  • stanaslot-1.xyz

  • sychologist-therapy-36914.bond

  • iandramonami.net

Targets

    • Target
      EDG9502024072.exe
    • Size 1.0MB
    • SHA256 7d58c8bd03c166d6a74bcec471538b4803d1ca9aa9d32f5a5286dd5aafea62ce
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookbi05discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks