Overview

overview

10

Static

static

1

jetss4321.exe

windows7-x64

10

jetss4321.exe

windows10-2004-x64

10

Resubmissions

09-11-2022 20:37

221109-zedkyabhf8 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8376238257.zip

  • Size

    201KB

  • Sample

    221109-zedkyabhf8

  • MD5

    18854778a5a723feca2be01a4746f412

  • SHA1

    0fdf207900fb0be0384a77747935f6cb26713a42

  • SHA256

    f7479084eeafec8f864bd281697b7f88ca32b1c6b76653767f66be83d4842c52

  • SHA512

    ec291ff4ccf68132e0b03aaf3551a820ca963c7f9f6bf99b9f775dcba04aabd4062ea4782e65fb9242cd339ae3be56df2de5b80988e5531d413ba7e11251caf2

  • SSDEEP

    6144:6qFQl8D/exf91FZPI0qyQeX3nnX4x2yPV:6qFQi/er7ZPoAno9N

Score
10/10
formbookje14ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je14

Decoy

innervisionbuildings.com

theenergysocialite.com

565548.com

panghr.com

onlyonesolutions.com

stjohnzone6.com

cnotes.rest

helfeb.online

xixi-s-inc.club

easilyentered.com

theshopx.store

mrclean-ac.com

miamibeachwateradventures.com

jpearce.co.uk

seseragi-bunkou.com

minimaddie.com

commbank-help-849c3.com

segohandelsonderneming.com

namthanhreal.com

fototerapi.online

Targets

    • Target

      jetss4321.exe

    • Size

      213KB

    • MD5

      0f558015aea4fab0704f0a81241c95de

    • SHA1

      701d1f39fd047f93543d63fa93b7cdf6ef29d1ee

    • SHA256

      983fe597e0687a206126a3a25d356b3f30431883e692fb1744c7d655b9b6ee59

    • SHA512

      19da1777a225f9d9f59717506758eb448721d1ed534338919a181d1a5471a116560601125e5cda4f75e4720f962dfada522cabcede7a633bf36ea40c8f638425

    • SSDEEP

      6144:qweEpTH0JdteiykaUKT3CR+AVTCkTgp3c2n7Zp:bD0JWkICEk2ki3c41p

    Score
    10/10
    formbookje14ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks