Overview

overview

10

Static

static

1

jetss4321.exe

windows7-x64

10

jetss4321.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    jetss4321.exe

  • Size

    213KB

  • Sample

    221102-17xd7accc8

  • MD5

    0f558015aea4fab0704f0a81241c95de

  • SHA1

    701d1f39fd047f93543d63fa93b7cdf6ef29d1ee

  • SHA256

    983fe597e0687a206126a3a25d356b3f30431883e692fb1744c7d655b9b6ee59

  • SHA512

    19da1777a225f9d9f59717506758eb448721d1ed534338919a181d1a5471a116560601125e5cda4f75e4720f962dfada522cabcede7a633bf36ea40c8f638425

  • SSDEEP

    6144:qweEpTH0JdteiykaUKT3CR+AVTCkTgp3c2n7Zp:bD0JWkICEk2ki3c41p

Score
10/10
formbookje14ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je14

Decoy

innervisionbuildings.com

theenergysocialite.com

565548.com

panghr.com

onlyonesolutions.com

stjohnzone6.com

cnotes.rest

helfeb.online

xixi-s-inc.club

easilyentered.com

theshopx.store

mrclean-ac.com

miamibeachwateradventures.com

jpearce.co.uk

seseragi-bunkou.com

minimaddie.com

commbank-help-849c3.com

segohandelsonderneming.com

namthanhreal.com

fototerapi.online

Targets

    • Target

      jetss4321.exe

    • Size

      213KB

    • MD5

      0f558015aea4fab0704f0a81241c95de

    • SHA1

      701d1f39fd047f93543d63fa93b7cdf6ef29d1ee

    • SHA256

      983fe597e0687a206126a3a25d356b3f30431883e692fb1744c7d655b9b6ee59

    • SHA512

      19da1777a225f9d9f59717506758eb448721d1ed534338919a181d1a5471a116560601125e5cda4f75e4720f962dfada522cabcede7a633bf36ea40c8f638425

    • SSDEEP

      6144:qweEpTH0JdteiykaUKT3CR+AVTCkTgp3c2n7Zp:bD0JWkICEk2ki3c41p

    Score
    10/10
    formbookje14ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks