Overview

overview

10

Static

static

1

UoiRTdCpIfgMI8G.exe

windows7-x64

10

UoiRTdCpIfgMI8G.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    UoiRTdCpIfgMI8G.exe
  • Size 725KB
  • Sample230216-p9scgahc21
  • SHA256 25f2b36dc8b2fb7c4d2694c9d4293de356f39d61732414be8b87e772aadcb30d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookoe26ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • oe26

Decoy

  • 455l.xyz

  • thewritetiger.com

  • geneticallyresilient.com

  • headlesstemplates.shop

  • xn--3-3fa.com

  • fatewayapi.com

  • yjgglp.com

  • fatmavildanserim.com

  • botmaia.online

  • bistline.foundation

  • ezhangfang.net

  • whitetigers.africa

  • hephzbeulah.africa

  • 44k.buzz

  • sunbedengineer.co.uk

  • davisonbooks.co.uk

  • dentalimplantsquotes.xyz

  • 84818.fans

  • grupomad.com

  • kimosr.com

Targets

    • Target
      UoiRTdCpIfgMI8G.exe
    • Size 725KB
    • SHA256 25f2b36dc8b2fb7c4d2694c9d4293de356f39d61732414be8b87e772aadcb30d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookoe26ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks