Overview

overview

10

Static

static

1

jets009576.exe

windows7-x64

10

jets009576.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    48178CAA9D162C7D9E80F7F5C0781B2C6CAAB7CDC975361A3A6ED510D4683B47

  • Size

    255KB

  • Sample

    221123-r2a5bsda8w

  • MD5

    ea44dd628ea488ef92b2016ee7aa642b

  • SHA1

    48450f4c047d441231f6e771e7a5eb032fda7dce

  • SHA256

    48178caa9d162c7d9e80f7f5c0781b2c6caab7cdc975361a3a6ed510d4683b47

  • SHA512

    92e5b053bec5a4202c3aa49cb5a75632d5911f6a7adb4d5b7574bff5db64cda2cfaac38385616ab0e351e57e4fc8cfb49d6c4ec6a7d67e1f6c054d924816ab57

  • SSDEEP

    6144:An9p/dfOF+NmCX29dpYObVaOKsPGq55QY2rqYE+r:2tfOFzCX29dpYObIIhp2rfzr

Score
10/10
formbookje14ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je14

Decoy

innervisionbuildings.com

theenergysocialite.com

565548.com

panghr.com

onlyonesolutions.com

stjohnzone6.com

cnotes.rest

helfeb.online

xixi-s-inc.club

easilyentered.com

theshopx.store

mrclean-ac.com

miamibeachwateradventures.com

jpearce.co.uk

seseragi-bunkou.com

minimaddie.com

commbank-help-849c3.com

segohandelsonderneming.com

namthanhreal.com

fototerapi.online

Targets

    • Target

      jets009576.exe

    • Size

      269KB

    • MD5

      1424f51c647f3f91ff8bd772ed81ad11

    • SHA1

      b9a60b20215d65bbf95e0ddbc1747a263e6ee0ff

    • SHA256

      bb0bf0449c531f9f84fadd5ab4df59906a9fda97d25677eedfc85d82f1470561

    • SHA512

      232c9f132e94d5acd12e75e3c747817cd4fa78a20cd06810840f30ceaceb9e7352c9f1e110a7f63fa88eb708ce1161e4938a8baaeada0a47cd5f24064eaadddf

    • SSDEEP

      6144:MEa0Nlg0SbqaRdlL3wTblUpk7BYDSx0gWw2zOVfo30qAy6cuu:XR/YlOUoKm2gWRqVfo30lxu

    Score
    10/10
    formbookje14ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks