Overview

overview

10

Static

static

aa205cebb1...f4.exe

windows7_x64

10

aa205cebb1...f4.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    aa205cebb1ffbbf7b96723fe050920f4
  • Size 604KB
  • Sample220331-trbzzsaffp
  • SHA256 f140ff41e79cf738d424556d3e3dfa7f7aef0d2d3991faa348d6090cc19f1da4
  • MD5 SHA1 SHA512
Score
10/10
formbookr2y0ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • r2y0

Decoy

  • arzoneproperty.com

  • pathtopronetwork.com

  • jasasumurborjawatimur.com

  • albertliang.info

  • subvipndg.site

  • fzmtzs.com

  • qianguodong.xyz

  • artifact-label.com

  • fuss-about.com

  • denimfactorylb.com

  • sbsmwkdnc.com

  • cdspaint.com

  • iloveyour.info

  • ballantineshotels.com

  • infoxcore.com

  • advisorlove.com

  • frauimmond.com

  • vibeplot.com

  • toje2523.xyz

  • masterbetting125.com

Targets

    • Target
      aa205cebb1ffbbf7b96723fe050920f4
    • Size 604KB
    • SHA256 f140ff41e79cf738d424556d3e3dfa7f7aef0d2d3991faa348d6090cc19f1da4
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookr2y0ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks