Overview

overview

10

Static

static

3

cc1b719f0a...67.exe

windows7-x64

10

cc1b719f0a...67.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    cc1b719f0ae40d0b53765aae8480474dbc7277428f56184d2dc94a0de5fbbf67.exe
  • Size 717KB
  • Sample240831-cd2vtazdkq
  • SHA256 cc1b719f0ae40d0b53765aae8480474dbc7277428f56184d2dc94a0de5fbbf67
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookhe2adiscoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • he2a

Decoy

  • 070001606.xyz

  • jesuseascriancas.online

  • as-eltransport.xyz

  • bankditalia-company.online

  • linkedin-stijngraat.online

  • sportsbetd.xyz

  • spanish-classes-76893.bond

  • infonation.pro

  • nxwzbze.forum

  • rush-pay.biz

  • fulfillmissions.lat

  • infolungcancer.xyz

  • aqario.xyz

  • omepro.solar

  • jackmanmueshl.shop

  • amcart.store

  • ishanaudichya.xyz

  • sun4rk.shop

  • depression-test-74287.bond

  • chipit.shop

Targets

    • Target
      cc1b719f0ae40d0b53765aae8480474dbc7277428f56184d2dc94a0de5fbbf67.exe
    • Size 717KB
    • SHA256 cc1b719f0ae40d0b53765aae8480474dbc7277428f56184d2dc94a0de5fbbf67
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookhe2adiscoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks