Overview

overview

10

Static

static

3

cca9sXT33VsAEdu.exe

windows7-x64

10

cca9sXT33VsAEdu.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cca9sXT33VsAEdu.exe

  • Size

    582KB

  • Sample

    240617-qv874sxcmj

  • MD5

    5824d7b76dcd8c106392e0739132a724

  • SHA1

    560fe3730f004369e25f455227a1a580c87c0154

  • SHA256

    c9abcfad837a889855fac86bb376f11a0383d2cd956c13b41546e62dd55fa199

  • SHA512

    36964f2cb0f979204b9638d4f1c6adba5c3b58c23d53029061b6f1f1910ffab124a14772b0673ffe978f646ad9235970e1d1cfbb0a9597371818481f2fd00e8e

  • SSDEEP

    12288:HfR/iFIsPAb/z/rNj3qPpZMshEtS0XEKz1MciRtiU9TAv9TiuQLsKOQwk58e/:/RkIKyb5j3qxOsAEKhMc8XsF2eKOQj

Score
10/10
formbookdy13ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dy13

Decoy

manga-house.com

kjsdhklssk51.xyz

b0ba138.xyz

bt365033.com

ccbsinc.net

mrwine.xyz

nrxkrd527o.xyz

hoshi.social

1912ai.com

serco2020.com

byfchfyr.xyz

imuschestvostorgov.online

austinheafey.com

mrdfa.club

883106.photos

profitablefxmarkets.com

taini00.net

brye.top

ginsm.com

sportglid.com

Targets

    • Target

      cca9sXT33VsAEdu.exe

    • Size

      582KB

    • MD5

      5824d7b76dcd8c106392e0739132a724

    • SHA1

      560fe3730f004369e25f455227a1a580c87c0154

    • SHA256

      c9abcfad837a889855fac86bb376f11a0383d2cd956c13b41546e62dd55fa199

    • SHA512

      36964f2cb0f979204b9638d4f1c6adba5c3b58c23d53029061b6f1f1910ffab124a14772b0673ffe978f646ad9235970e1d1cfbb0a9597371818481f2fd00e8e

    • SSDEEP

      12288:HfR/iFIsPAb/z/rNj3qPpZMshEtS0XEKz1MciRtiU9TAv9TiuQLsKOQwk58e/:/RkIKyb5j3qxOsAEKhMc8XsF2eKOQj

    Score
    10/10
    formbookdy13ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks