Overview

overview

10

Static

static

3

0nazQxrt5MZ5BRK.exe

windows7-x64

10

0nazQxrt5MZ5BRK.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    0nazQxrt5MZ5BRK.exe
  • Size 770KB
  • Sample240905-tcrrwstfqm
  • SHA256 3e4d309ea6393d0740a3bd93c83b208ac59b3ddf2626bb279942ac48003454de
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookhe2adiscoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • he2a

Decoy

  • 070001606.xyz

  • jesuseascriancas.online

  • as-eltransport.xyz

  • bankditalia-company.online

  • linkedin-stijngraat.online

  • sportsbetd.xyz

  • spanish-classes-76893.bond

  • infonation.pro

  • nxwzbze.forum

  • rush-pay.biz

  • fulfillmissions.lat

  • infolungcancer.xyz

  • aqario.xyz

  • omepro.solar

  • jackmanmueshl.shop

  • amcart.store

  • ishanaudichya.xyz

  • sun4rk.shop

  • depression-test-74287.bond

  • chipit.shop

Targets

    • Target
      0nazQxrt5MZ5BRK.exe
    • Size 770KB
    • SHA256 3e4d309ea6393d0740a3bd93c83b208ac59b3ddf2626bb279942ac48003454de
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookhe2adiscoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks