Overview

overview

10

Static

static

3

Payment slip TT.exe

windows7-x64

10

Payment slip TT.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f55312e5242f14dc500d5e8e72059b5a470afcf9dbf145a46617626874399bd0

  • Size

    596KB

  • Sample

    241105-qycy3s1nex

  • MD5

    9841794bc88dfc8df8f5d80135ebf8c9

  • SHA1

    e2136760618dcdf5dcda269fa76558b94cc28cf0

  • SHA256

    f55312e5242f14dc500d5e8e72059b5a470afcf9dbf145a46617626874399bd0

  • SHA512

    ab213c1a24294cd2a2549616f6980a72a7f69c50603cf6fc1833c4430b1c5b53eb197295bc307fa8e1b3108febb426599dc145cf826af2290e48ce7fc816a438

  • SSDEEP

    12288:PPmx4he4IPBnbxgVDtW98BaxyM5TsmhZ5sRrDUUJdtdaveg:P+x4+Zdg5di35Q+AR3drIWg

Score
10/10
formbookm25sdiscoveryratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m25s

Decoy

araghospitality.net

cleans.xyz

olnacasinotcs14.top

pringhillinfos.net

erkakasrumah.online

orean-course-289113002.zone

yeloma-treatment-82106.bond

76iw543gw.autos

nline-shopping-56055.bond

enetik.xyz

ax-th-6011838.fyi

itygatehousing.app

23zy998jk.bond

pslag-hal-2.online

uykoii.shop

9supjub3p.buzz

tmgl.bond

actus-catering-creations.net

ntercashspace24.homes

ierra777.vip

Targets

    • Target

      Payment slip TT.exe

    • Size

      730KB

    • MD5

      5643e7a6dd9dcdb73826348ffc0e4a5c

    • SHA1

      d817b6131b61597c2fe9dcfc2aec0ce2341adeb4

    • SHA256

      794f51202f35431d4b1523aebd8f72ec72cdac3b53a297ae256010567d5aae84

    • SHA512

      d7bec53c63465a7ae5779e96af07f54290f15afee58d9b5fa284ae564976f2f27a4a202b9306fe8bc5255502bb97818e37178712eb58b58cde95cb4b3bad48d0

    • SSDEEP

      12288:fFgX2D0LK8uX3OAVDtWx8LaxyE5TWh2Lq/c+RK09X:9gmDAm55fAd5q2uU+RV

    Score
    10/10
    formbookm25sdiscoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook family

      formbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks