Overview

overview

10

Static

static

3

9867dc4c4a...70.exe

windows7-x64

10

9867dc4c4a...70.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe
  • Size 968KB
  • Sample230608-mxtcwsed99
  • SHA256 9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookgg04ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • gg04

Decoy

  • clothandsoulfabricllc.com

  • kx1336.com

  • 4638.global

  • fixlaunchcredtunionmemb.online

  • indivexport.com

  • betuluzun.online

  • colossusboutique.com

  • hgcst.com

  • authorizer.online

  • hong-travel.com

  • globalwealthstrategiesco.com

  • fobberq.com

  • tribally.net

  • cook-a.com

  • todipjane.africa

  • membershipexams.africa

  • 3dseal.online

  • abris-spb.ru

  • mkkkkk.net

  • chargecentral.store

Targets

    • Target
      9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970.exe
    • Size 968KB
    • SHA256 9867dc4c4aad89a47aa9fcdc726b5296dac1a3150520140e6d7da4836448d970
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookgg04ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks