Overview

overview

10

Static

static

5

Payment advice.exe

windows7-x64

10

Payment advice.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99949de6387b38b04db2ff140d3b98b48d4087a36d62c5ad1feb35ddf513b75c

  • Size

    835KB

  • Sample

    240918-f2a9jsvbjc

  • MD5

    35a96755594bc6fffefd7e651b9cf290

  • SHA1

    5355306d237120299c5a6fd0aeac2a2b040c17d8

  • SHA256

    99949de6387b38b04db2ff140d3b98b48d4087a36d62c5ad1feb35ddf513b75c

  • SHA512

    4068c770fc38ee2b0ccc2feae2c365baa01a7844868858788df415fee26f7a195e8e882d97a7af7c27b8f33f949c454c6a6990e2b1319001b03a20c850a809a5

  • SSDEEP

    24576:EzFh6Ax5KkdYBlEui2IktW//xG+B3HkaF5:AFh6MKkWUmIVxG+ZHF

Score
10/10
formbookc24tdiscoveryratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

c24t

Decoy

ealthbridgeccs.online

ngelicais.art

uktuksu1.sbs

fapoker.asia

hecreature.tech

orenzoplaybest14.xyz

op-smartphones-deal.today

delark.click

7395.asia

otnews.cfd

j16e.xyz

oko.events

fscxb.top

roudtxliberals.vote

asas-br.bond

ourhealthyourlife.shop

fbpd.top

j9u9.xyz

uijiuw.top

aming-chair-37588.bond

Targets

    • Target

      Payment advice.exe

    • Size

      1.1MB

    • MD5

      c4df2419b7cf73964d33c01e106bed42

    • SHA1

      710da0825122e74b972e2e9b4e42b62a281957a6

    • SHA256

      54d753e9c1a1f7c5016bcf820b09f7626166de0097478617939ac31995161556

    • SHA512

      d0c2285e1dbbf649651b669dba6f1503664636df8ebd0d51adbb85d8905f191b5f13a69c95d40a28e1af9a3c2afd580531006a86b2a6d44787203121675f9448

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaCxmaKktGRHnGCB3xkaFL:7JZoQrbTFZY1iaCNKfRGCVxH

    Score
    10/10
    formbookc24tdiscoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks