Overview

overview

10

Static

static

5

4fe0627df4...a3.exe

windows7-x64

10

4fe0627df4...a3.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4fe0627df409d563c49daaace6f559559c940ccf1d19e73dc3480a33f86ed9a3.exe
  • Size 1.1MB
  • Sample240905-bp56ya1eqa
  • SHA256 4fe0627df409d563c49daaace6f559559c940ccf1d19e73dc3480a33f86ed9a3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookbi05discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • bi05

Decoy

  • ollow-the-bit.online

  • aopho.autos

  • 14ra567dp.autos

  • 48651301.top

  • ussian-dating-54714.bond

  • sychology-degree-80838.bond

  • lytracker.xyz

  • strology-forest.sbs

  • swjbcl3.top

  • ridgenexttechnologies.partners

  • lroy.sbs

  • kyscreen.vip

  • anhit.live

  • uckyheart.xyz

  • orddserials.online

  • hetune.shop

  • nherited-traits-ant.bond

  • stanaslot-1.xyz

  • sychologist-therapy-36914.bond

  • iandramonami.net

Targets

    • Target
      4fe0627df409d563c49daaace6f559559c940ccf1d19e73dc3480a33f86ed9a3.exe
    • Size 1.1MB
    • SHA256 4fe0627df409d563c49daaace6f559559c940ccf1d19e73dc3480a33f86ed9a3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookbi05discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks