Overview

overview

10

Static

static

25c18c9e08...77.exe

windows7_x64

10

25c18c9e08...77.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    25c18c9e08ee26ca5155c09eaa020377
  • Size 762KB
  • Sample220408-ll2pfsbfb6
  • SHA256 2a48c2b3780f6b0f3fd3f3f05f54066f465870e6f534237a5d283ee079882828
  • MD5 SHA1 SHA512
Score
10/10
formbooks20aratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • s20a

Decoy

  • kingdomscouncil.com

  • calavera.ink

  • 99bds.com

  • newbetsites.com

  • foldandrelax.com

  • liumilac.com

  • hightidestattoo.com

  • hoschtonplumbers.com

  • deoranjewinter.com

  • awinterart.com

  • zmpeudz.icu

  • jsemw105.com

  • landrover-africa.com

  • 371018.com

  • mhasale.com

  • philipmawford.com

  • acorn97.com

  • kexin158.com

  • dxhjtsq.com

  • lekarbg.com

Targets

    • Target
      25c18c9e08ee26ca5155c09eaa020377
    • Size 762KB
    • SHA256 2a48c2b3780f6b0f3fd3f3f05f54066f465870e6f534237a5d283ee079882828
    • MD5 SHA1 SHA512
    Score
    10/10
    formbooks20aratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks