Overview

overview

10

Static

static

3

b56ce6c544...9c.exe

windows7-x64

10

b56ce6c544...9c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b56ce6c54428054e755a2e56f6cf009c.exe
  • Size 610KB
  • Sample230810-vctrxsha41
  • SHA256 bbd52311d6f6fcc5e1c1296fb53932cac1445ed4d3fe3872a2a8de1f83bd1bf0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookge83ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ge83

Decoy

  • zqgf529.com

  • ohrana-truda-truda-rf.online

  • alyasra-sa.com

  • luxurynev.com

  • glassfactorycaribe.com

  • computechitsolutions.info

  • chillbeathk.com

  • fxphones.com

  • glamvoyager.com

  • empresaspiana.com

  • doraemon.center

  • jobstora.xyz

  • clicasaqui.com

  • shopchanticleers.com

  • xrworldnft.xyz

  • xrtrump.com

  • nirapottabd.com

  • azino777-600.buzz

  • 2223malcolm.com

  • darunfayxaklf.vip

Targets

    • Target
      b56ce6c54428054e755a2e56f6cf009c.exe
    • Size 610KB
    • SHA256 bbd52311d6f6fcc5e1c1296fb53932cac1445ed4d3fe3872a2a8de1f83bd1bf0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookge83ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks