Overview

overview

10

Static

static

LVvoucher.exe

windows7_x64

3

LVvoucher.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    LVvoucher.lzh
  • Size 394KB
  • Sample220128-kd64jaade3
  • SHA256 36d8a4369922f9ff965bc763a9f8ee775b4e4377fcd0d60ffdd58e742209f5d4
  • MD5 SHA1 SHA512
Score
10/10
formbookoh75ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • oh75

Decoy

  • denizgidam.com

  • 6cc06.com

  • charlottewaldburgzeil.com

  • medijanus.com

  • qingdaoyiersan.com

  • datcabilgisayar.xyz

  • 111439d.com

  • xn--1ruo40k.com

  • wu6enxwcx5h3.xyz

  • vnscloud.net

  • brtka.xyz

  • showztime.com

  • promocoesdedezenbro.com

  • wokpy.com

  • chnowuk.online

  • rockshotscafe.com

  • pelrjy.com

  • nato-riness.com

  • feixiang-chem.com

  • thcoinexchange.com

Targets

    • Target
      LVvoucher.exe
    • Size 779KB
    • SHA256 77604e2646be4fb59a16e33ca5e78a73ec5045b8f1cce6f5ba16c11304b1c2ee
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookoh75ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks