Overview

overview

10

Static

static

5

9b250f96c8...46.exe

windows7-x64

10

9b250f96c8...46.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9b250f96c8e383893d2c2f0ae940312d86e6aec8d0e27aadd9087dce67d17c46.exe
  • Size 1.0MB
  • Sample241114-db36jaxkar
  • SHA256 9b250f96c8e383893d2c2f0ae940312d86e6aec8d0e27aadd9087dce67d17c46
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookge07discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ge07

Decoy

  • amyard.shop

  • eloshost.xyz

  • g18q11a.top

  • orensic-vendor-735524320.click

  • ithin-ksvodn.xyz

  • xhyx.top

  • elonix-traceglow.pro

  • cillascrewedsedroth.cfd

  • wner-nyquh.xyz

  • reyhazeusa.shop

  • esmellretaperetotal.cfd

  • hqm-during.xyz

  • pipagtxcorrelo.xyz

  • lray-civil.xyz

  • apybarameme.xyz

  • rbuds.shop

  • hild-fcudh.xyz

  • rkgexg.top

  • estwestcottwines.shop

  • giyztm.xyz

Targets

    • Target
      9b250f96c8e383893d2c2f0ae940312d86e6aec8d0e27aadd9087dce67d17c46.exe
    • Size 1.0MB
    • SHA256 9b250f96c8e383893d2c2f0ae940312d86e6aec8d0e27aadd9087dce67d17c46
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookge07discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook family

      formbook

    • Formbook payload

      rat

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks