Overview

overview

10

Static

static

5

tmp4kn5nim2.exe

windows10-ltsc_2021-x64

10

tmp4kn5nim2.exe

windows10-2004-x64

10

tmp4kn5nim2.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmp4kn5nim2
  • Size 1.1MB
  • Sample260602-pmwflsds4v
  • SHA256 928975e4ecab24ccc51bf414c18c63726c02da727803283b70a22f61046911cf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
formbookms84discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ms84

Decoy

  • ecurity-ukgaxq.xyz

  • 45ee.top

  • risiddivinayaka.net

  • tizip-skill.xyz

  • ostcanadantet.top

  • 764.xyz

  • oco188rtp.xyz

  • lobalacessory.shop

  • qcq-serve.xyz

  • dameth.top

  • arge-eycert.xyz

  • yzwj-she.xyz

  • bgfrp-plant.xyz

  • emesiartwork.net

  • rcw-hotel.xyz

  • loor-dfqzpi.xyz

  • vidence-zvkkln.xyz

  • oisthuchoyarura.shop

  • 959108ttltxfm842.top

  • apzcc-both.xyz

Targets

    • Target
      tmp4kn5nim2
    • Size 1.1MB
    • SHA256 928975e4ecab24ccc51bf414c18c63726c02da727803283b70a22f61046911cf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    ms84discoveryformbookratspywarestealertrojan

    • Family: Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v16

Tasks