Overview

overview

10

Static

static

3

223de4efb0...17.exe

windows7-x64

10

223de4efb0...17.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    223de4efb0c50f487d0bef8adeda7317.exe
  • Size 1.2MB
  • Sample230622-kep7eadd24
  • SHA256 08d32fc257cd9dfd7bac9f1e5fa15776d6842bed5f695a24f7345556af00bd4c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookns62ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ns62

Decoy

  • 7.phd

  • jhxcbhjsbs.buzz

  • lehighduplex.com

  • dapurmodifikasi.com

  • jipf3uq.top

  • ruishijd.com

  • hhs1973reunion.com

  • azxteri.xyz

  • liyounengyuan.com

  • wonderexpertise.com

  • thesmokeydungeon.com

  • calmmotion.store

  • liniesspiega.xyz

  • staiccautes.cfd

  • 161be4c34847.com

  • c0ffeebit.com

  • h7tfyg53fe.com

  • gs779.vip

  • decorandotufiesta.com

  • greenbottle.online

Targets

    • Target
      223de4efb0c50f487d0bef8adeda7317.exe
    • Size 1.2MB
    • SHA256 08d32fc257cd9dfd7bac9f1e5fa15776d6842bed5f695a24f7345556af00bd4c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookns62ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks