Overview

overview

10

Static

static

3

9266ece6d7...33.exe

windows7-x64

7

9266ece6d7...33.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f100b637fa8bc6f97f3bac5fe25cf5539a93c83795f0dfe22c8136282dd866a2

  • Size

    314KB

  • Sample

    240903-q23znsybkp

  • MD5

    94b1b5b8e1eacfa23f3f1054a5c0681d

  • SHA1

    f98206080c4bc799d25c76215a66e0c317644d0e

  • SHA256

    f100b637fa8bc6f97f3bac5fe25cf5539a93c83795f0dfe22c8136282dd866a2

  • SHA512

    ccea42d285053369d546e1c37d6c423c0a99efab91c2ec1736048d9d01399ea8ddfb125e3cf01d3854c7bdf00b42ea329861516bba4424517b0c371f28aa66a3

  • SSDEEP

    6144:WaDT4FBp2AYx9KcnEthV11WPWr1ba9hoPxeWDr60IXses5W9wZA2J:PTIH2AYXKeEXV31ba9hoP8SM8PAaAA

Score
10/10
formbooks6tndiscoveryratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s6tn

Decoy

ya-volna.com

nakimura.online

buildtheyamato.com

carecard.xyz

orthozayn.com

sitd.xyz

garu.club

alfainfocom.com

floridalacrossecamps.com

banytus.xyz

dogodipiskot.quest

ljlsaf.com

shaheenricemills.com

cuevieujni.info

chrisandkcollection.com

sunadokei.website

hoidotsbirky.quest

creditassociatesllc.com

amazonhrjobs.com

the-luggage-dropp-off.com

Targets

    • Target

      9266ece6d7847e789355c680f49e4eb1fed2417e88b9fbd780e76e5f3ffcab33

    • Size

      519KB

    • MD5

      f55f34179b9927413e1b8e03428219b5

    • SHA1

      6794de0e21b2dcf6844e6c27d7391105ee9bf1ef

    • SHA256

      9266ece6d7847e789355c680f49e4eb1fed2417e88b9fbd780e76e5f3ffcab33

    • SHA512

      079e23fd13c75923c1510b35b8c8559d774982a5ce991483bcb6d2e0a8f6b0870bd5eca57926acedbdfccd71249148f26e76b7fb353673c2076678f60a20570f

    • SSDEEP

      6144:2i5IN9bX6qUhFFGzaX/yuWUJeLC5MiTMXp6LNXlTEGtxhezzK3iU8dEHK:2i5ID6qUbFhyAXocLNNVtuXEHK

    Score
    10/10
    discoveryformbooks6tnratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks