Overview

overview

10

Static

static

5

tmpo8vebizd.exe

windows10-ltsc_2021-x64

10

tmpo8vebizd.exe

windows10-2004-x64

10

tmpo8vebizd.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmpo8vebizd
  • Size 1.1MB
  • Sample260602-qa2brsdy7t
  • SHA256 1894c222066a2123ead5e5bbdaea7fbb06d0ce2acddf5da9ae4bd9969276f1ae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
formbookoh16discoverypersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • oh16

Decoy

  • neiromeme.com

  • lijahalvarez.com

  • z32us8.info

  • croxnorth.com

  • dsazv.xyz

  • irjp7f.info

  • p47uaxz.sbs

  • q-s-wythorm.top

  • gemstore.web.id

  • boringlocal.fr

  • imtkmrliixj.top

  • trustbasedsociety.com

  • pufybai4.pro

  • vkvge-rnw2m-mcleoi.work

  • ligavpn.online

  • alignedyes.com

  • zmsaxzs.bond

  • ascendiadesignvision.com

  • p305fyn34.shop

  • infinovative.com

Targets

    • Target
      tmpo8vebizd
    • Size 1.1MB
    • SHA256 1894c222066a2123ead5e5bbdaea7fbb06d0ce2acddf5da9ae4bd9969276f1ae
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    oh16discoveryformbookratspywarestealertrojanpersistence

    • Family: Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v16

Tasks