Overview

overview

10

Static

static

1

jetss4321.exe

windows7-x64

10

jetss4321.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BDB2C9E0C8069E6E61FE1971E88A238F01F118E6CF920010D64B806DEA954483

  • Size

    201KB

  • Sample

    221213-2pz8ssbc7z

  • MD5

    56de9ca1dea237d022eded1a7592d65c

  • SHA1

    93701de1c14183ce2006704f88bd55d8377d15a1

  • SHA256

    bdb2c9e0c8069e6e61fe1971e88a238f01f118e6cf920010d64b806dea954483

  • SHA512

    9fa6a72ec2d19f943bf8f227b281635db03a9ae4fbedf6879d8e4e961bd733d798d48121f1ef7baa8f08968d92d337854bef8275d46b95ab74e71624004c7bf1

  • SSDEEP

    3072:OTGDF1WlHeYr9eNMcKSDYaNHmtTLsA8ly5oo+48jVRfAMzKgRIsOFD4Kd/RO3SQ+:nDmGMcNmH8ly5S5DYM2gRIsu4oZpQ+

Score
10/10
formbookje14ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

je14

Decoy

innervisionbuildings.com

theenergysocialite.com

565548.com

panghr.com

onlyonesolutions.com

stjohnzone6.com

cnotes.rest

helfeb.online

xixi-s-inc.club

easilyentered.com

theshopx.store

mrclean-ac.com

miamibeachwateradventures.com

jpearce.co.uk

seseragi-bunkou.com

minimaddie.com

commbank-help-849c3.com

segohandelsonderneming.com

namthanhreal.com

fototerapi.online

Targets

    • Target

      jetss4321.exe

    • Size

      213KB

    • MD5

      0f558015aea4fab0704f0a81241c95de

    • SHA1

      701d1f39fd047f93543d63fa93b7cdf6ef29d1ee

    • SHA256

      983fe597e0687a206126a3a25d356b3f30431883e692fb1744c7d655b9b6ee59

    • SHA512

      19da1777a225f9d9f59717506758eb448721d1ed534338919a181d1a5471a116560601125e5cda4f75e4720f962dfada522cabcede7a633bf36ea40c8f638425

    • SSDEEP

      6144:qweEpTH0JdteiykaUKT3CR+AVTCkTgp3c2n7Zp:bD0JWkICEk2ki3c41p

    Score
    10/10
    formbookje14ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks