Overview

overview

10

Static

static

895d492abf...77.exe

windows7_x64

10

895d492abf...77.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    895d492abf6057079a739970f3666977.exe
  • Size 534KB
  • Sample220113-te53asbce7
  • SHA256 c4e0e2fd9fc5399619706e67a776832eeb09461874f035a75a7b8e047fb964a0
  • MD5 SHA1 SHA512
Score
10/10
formbookd2z8ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • d2z8

Decoy

  • jameshenrycfa.com

  • hearing-siemens.com

  • way2noteshub.com

  • metaswapdex.com

  • car-electronic-performance.com

  • aspurgentcare.com

  • htedbchd.website

  • lojakaton.online

  • trukorera.online

  • sevenstoners.com

  • herlihygaragedoors.com

  • starforspotify.com

  • catilaf.com

  • iagroupsocial.com

  • ranchrealestatetx.com

  • wu7btbn1zv9y.xyz

  • realvrz.com

  • needljlane.xyz

  • newsreaderdynamo.com

  • nasser-group.com

Targets

    • Target
      895d492abf6057079a739970f3666977.exe
    • Size 534KB
    • SHA256 c4e0e2fd9fc5399619706e67a776832eeb09461874f035a75a7b8e047fb964a0
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookd2z8ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks