Overview

overview

10

Static

static

3

PO 026235M...c..exe

windows7-x64

10

PO 026235M...c..exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PO 026235Medline (Shanghai) Industries, Inc..exe
  • Size 739KB
  • Sample241107-lbbqaazcje
  • SHA256 07888aca315d288cf934104bbee91f5a2d6cec258f9e8052adfb496cc7ea1f16
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookmd49discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • md49

Decoy

  • enithpro.shop

  • utozeed.agency

  • ornpicsbd.xyz

  • 82yjj301.top

  • kphone.online

  • 3ccha73hdl5.shop

  • seinow.online

  • usurrofest.info

  • 2ads2s2.top

  • oritskul.net

  • etlivecasino.bet

  • erts.navy

  • anieubezpieczenia.online

  • dyhph1020pm.top

  • paceglide.space

  • ibmedia.net

  • arwyking.icu

  • soriaticarthritis101.today

  • earopia.shop

  • gctg2qt4h.top

Targets

    • Target
      PO 026235Medline (Shanghai) Industries, Inc..exe
    • Size 739KB
    • SHA256 07888aca315d288cf934104bbee91f5a2d6cec258f9e8052adfb496cc7ea1f16
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookmd49discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook family

      formbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks