Overview

overview

10

Static

static

3

Purchase S...95.exe

windows7-x64

1

Purchase S...95.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Purchase Samples-404995.exe
  • Size 594KB
  • Sample230911-mbc4safe29
  • SHA256 49c64577ddf3ce2e1f43c7832736e395b7e205132dd13c42e58be6a769a50832
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookhh36ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • hh36

Decoy

  • classyselects.com

  • wwwwesternjournal.com

  • em4466.com

  • youngkin.team

  • zuozhanggui.com

  • 628lakeview.com

  • emporiodaterragourmet.site

  • haferenvironmental.com

  • samgifarm.com

  • forgingbridgeacoramidis.com

  • supervarejobr.com

  • kedstry.xyz

  • ssongg2223.cfd

  • johannesstein.net

  • fastplumber.net

  • codullam.com

  • onemore-ikebukuro.com

  • ingarossi.net

  • calibratedstrengthcoaching.com

  • shisy3.xyz

Targets

    • Target
      Purchase Samples-404995.exe
    • Size 594KB
    • SHA256 49c64577ddf3ce2e1f43c7832736e395b7e205132dd13c42e58be6a769a50832
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookhh36ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks