Overview

overview

10

Static

static

38bb52be5f...d5.exe

windows7_x64

1

38bb52be5f...d5.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    38bb52be5f33531c14022cc2d6c124d5
  • Size 650KB
  • Sample220512-c3kmtsbcbk
  • SHA256 2e55e2c67fa00e3e955098409e3ee4037367af854f657cbbc83d5931b4355c36
  • MD5 SHA1 SHA512
Score
10/10
formbookn4w3ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • n4w3

Decoy

  • fortune093.xyz

  • animuso.com

  • flylawfirm.com

  • healthya2ghee.com

  • catalyticconverterinsurance.com

  • rg6899rg6899.com

  • chezseneba.com

  • reason.center

  • bai315.com

  • e6pai.com

  • bollyholic.xyz

  • jobassistbd.com

  • k8yyds.com

  • ijinyuangamazon.com

  • mocalog.tech

  • buktibaru.com

  • cj1musicandsound.biz

  • liehutejingdui.top

  • izumi.fans

  • ykgbs.com

Targets

    • Target
      38bb52be5f33531c14022cc2d6c124d5
    • Size 650KB
    • SHA256 2e55e2c67fa00e3e955098409e3ee4037367af854f657cbbc83d5931b4355c36
    • MD5 SHA1 SHA512
    Score
    10/10
    formbookn4w3ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks