Overview

overview

10

Static

static

5

tmpu0gn1n84.exe

windows10-ltsc_2021-x64

10

tmpu0gn1n84.exe

windows10-2004-x64

10

tmpu0gn1n84.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmpu0gn1n84
  • Size 1.1MB
  • Sample260602-qwf8qaew2s
  • SHA256 144b3e4d1f963e0fc6dd419df16c8eed0a2d816727ff2629e7e1aab5c0d3f243
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
formbookoh16discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • oh16

Decoy

  • addoridgethanksgiving.com

  • enofficeworksy.com

  • ni38g69.bond

  • allbrooktransmission.com

  • tresgsg.xyz

  • j3ztuf.bond

  • abincreekcanineretreat.ca

  • yjvai60.cfd

  • ilysc.shop

  • mga7mo0.bond

  • hirdnoodle.com

  • sdtbank.io

  • hred-r-threads.com

  • 1x0syys.bond

  • ascova.net

  • iseabovetomorrow.com

  • eadgendv.com

  • winuniv.com

  • lqssn0c.bond

  • qtslvm.info

Targets

    • Target
      tmpu0gn1n84
    • Size 1.1MB
    • SHA256 144b3e4d1f963e0fc6dd419df16c8eed0a2d816727ff2629e7e1aab5c0d3f243
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    oh16discoveryformbookratspywarestealertrojan

    • Family: Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v16

Tasks