Overview

overview

10

Static

static

jetsoff665432.exe

windows7-x64

10

jetsoff665432.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    jetsoff665432.exe

  • Size

    1.3MB

  • Sample

    220929-ktap9sabg7

  • MD5

    dfb1e6c9726254c500fe211973053292

  • SHA1

    ce5dd1136d279c35ec575a1928b3cbb06d767ddd

  • SHA256

    2f5bfb6d82efab99d275d142f253dec133f478a5f7e22cecc6c7a821ff69bf78

  • SHA512

    a0423019185a544a2c0bf9c351be5ca1eeb6863c29db46d29e8543403e00dbb52d292353428e9273bd78e13a27a4de67badeec3d24a6381b9415e77909fa90b3

  • SSDEEP

    24576:iAOcZXp0QToITuXx/kzFjPUkjPV99npuezy71oporah+zS:o2KVkJjPUkj9fZe6Gs

Score
10/10
formbookje14ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je14

Decoy

innervisionbuildings.com

theenergysocialite.com

565548.com

panghr.com

onlyonesolutions.com

stjohnzone6.com

cnotes.rest

helfeb.online

xixi-s-inc.club

easilyentered.com

theshopx.store

mrclean-ac.com

miamibeachwateradventures.com

jpearce.co.uk

seseragi-bunkou.com

minimaddie.com

commbank-help-849c3.com

segohandelsonderneming.com

namthanhreal.com

fototerapi.online

Targets

    • Target

      jetsoff665432.exe

    • Size

      1.3MB

    • MD5

      dfb1e6c9726254c500fe211973053292

    • SHA1

      ce5dd1136d279c35ec575a1928b3cbb06d767ddd

    • SHA256

      2f5bfb6d82efab99d275d142f253dec133f478a5f7e22cecc6c7a821ff69bf78

    • SHA512

      a0423019185a544a2c0bf9c351be5ca1eeb6863c29db46d29e8543403e00dbb52d292353428e9273bd78e13a27a4de67badeec3d24a6381b9415e77909fa90b3

    • SSDEEP

      24576:iAOcZXp0QToITuXx/kzFjPUkjPV99npuezy71oporah+zS:o2KVkJjPUkj9fZe6Gs

    Score
    10/10
    formbookje14ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks