Overview

overview

10

Static

static

5

Bill for t...st.exe

windows7-x64

10

Bill for t...st.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Bill for the Month of August.exe
  • Size 1.1MB
  • Sample240902-pawkva1ane
  • SHA256 ad796730fe76da567b892419b2cdba44eeaef29bf62b637c3c3af4cce42886ce
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookpt46discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • pt46

Decoy

  • twinportslocal.com

  • rovor.store

  • 98169.club

  • mdywl.com

  • jrd3s.rest

  • aston1717.top

  • floridawoodworkingmachinery.com

  • 17tk555t.com

  • ankitsho.shop

  • seclameh.com

  • realrecordlabel.com

  • trenchonbirmingham.com

  • af28.top

  • rtp1kenzototo.com

  • theselflovesite.com

  • promotegetpaid.info

  • strategiclogisticsagency.com

  • learneracademy.net

  • per-watch.com

  • betbox2341.com

Targets

    • Target
      Bill for the Month of August.exe
    • Size 1.1MB
    • SHA256 ad796730fe76da567b892419b2cdba44eeaef29bf62b637c3c3af4cce42886ce
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookpt46discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks