Overview

overview

10

Static

static

5

SWIFT_8045...02.exe

windows7-x64

10

SWIFT_8045...02.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SWIFT_804571426993002.exe
  • Size 1.1MB
  • Sample240926-f5z23sshkf
  • SHA256 444c7700cea589c8eadd8a51a9253cc1889900faf0eef882fb31bff858e34350
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooke62sdiscoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • e62s

Decoy

  • ellinksa.shop

  • uckyspinph.xyz

  • owdark.net

  • arriage-therapy-72241.bond

  • w7ijko4rv4p97b.top

  • heirbuzzwords.buzz

  • aspart.shop

  • ctivemail5-kagoya-com.info

  • shacertification9.shop

  • zitcd65k3.buzz

  • llkosoi.info

  • ru8.info

  • rhgtrdjdjykyetrdjftd.buzz

  • yschoollist.kiwi

  • oftfolio.online

  • rograma-de-almacen-2.online

  • oudoarms.top

  • mwquas.xyz

  • orjagaucha.website

  • nlinechat-mh.online

Targets

    • Target
      SWIFT_804571426993002.exe
    • Size 1.1MB
    • SHA256 444c7700cea589c8eadd8a51a9253cc1889900faf0eef882fb31bff858e34350
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooke62sdiscoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks