Overview

overview

10

Static

static

1

oZF2kXw4ZRc8NjL.exe

windows7-x64

10

oZF2kXw4ZRc8NjL.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    oZF2kXw4ZRc8NjL.exe
  • Size 598KB
  • Sample240311-hs782aed79
  • SHA256 f2afb3f2fc399a22f91d7697807904a9890f2bfa18c8c78a3dfc623e7c23815d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookns03ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ns03

Decoy

  • dipity.tech

  • agathis.fun

  • ekaterinai.store

  • elizabethsbookshelf.com

  • smilesustainably.com

  • tapeworm.xyz

  • beatricesswarthout.xyz

  • nsrpackersandpackers.in

  • yedxec.xyz

  • gildedbeautyaesthitics.com

  • hanibalbechar.com

  • fichaphuman.net

  • adilosk.shop

  • geezaran.com

  • ventasemail.com

  • phonecasesdirect.store

  • rctjuc.shop

  • sukimossmanagement.com

  • caller-id.today

  • kft07.vip

Targets

    • Target
      oZF2kXw4ZRc8NjL.exe
    • Size 598KB
    • SHA256 f2afb3f2fc399a22f91d7697807904a9890f2bfa18c8c78a3dfc623e7c23815d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookns03ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks