Overview

overview

10

Static

static

3

1d024b5fb2...18.exe

windows7-x64

10

1d024b5fb2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d024b5fb222f690e2437776dba5cecd_JaffaCakes118

  • Size

    431KB

  • Sample

    240329-j1kclsdf87

  • MD5

    1d024b5fb222f690e2437776dba5cecd

  • SHA1

    3bc42dd5835072842a7dbe4bc75db9480d4781e9

  • SHA256

    dfa72cfd2cf8b1c3beac907a91042e344a301923e8e40b88541e850161eae6eb

  • SHA512

    e1812ba005ed0d873cc43233d156f35b126d47228ec204900137f3676685a501ab1440b45d50b66b72da9114421d292f60ff1bbe817ea7200ef8c0a54cce2b51

  • SSDEEP

    12288:NVKqL95GKVh5QIXIxUOCY+5JHgc/73EW6kSb836D4X4pznu:NV9NB6+5Wc/7UWobAiOMnu

Score
10/10
formbookh0gdratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

h0gd

Decoy

hispansud.com

sanslisin156.com

izmediajo.com

fukugyo-kuchicomi.net

zjzmkj.net

powerupinnovations.com

unigradecuracao.net

inspirasimagz.com

isaacnqwilliams.store

john316graphics.net

wcparadise.net

trejoblanco.com

100x100cultura.com

beedivinehomedecor.com

polant.xyz

ascrete.com

www23855.com

emmagx.com

rekotalent.biz

fersamultiservicios.com

Targets

    • Target

      1d024b5fb222f690e2437776dba5cecd_JaffaCakes118

    • Size

      431KB

    • MD5

      1d024b5fb222f690e2437776dba5cecd

    • SHA1

      3bc42dd5835072842a7dbe4bc75db9480d4781e9

    • SHA256

      dfa72cfd2cf8b1c3beac907a91042e344a301923e8e40b88541e850161eae6eb

    • SHA512

      e1812ba005ed0d873cc43233d156f35b126d47228ec204900137f3676685a501ab1440b45d50b66b72da9114421d292f60ff1bbe817ea7200ef8c0a54cce2b51

    • SSDEEP

      12288:NVKqL95GKVh5QIXIxUOCY+5JHgc/73EW6kSb836D4X4pznu:NV9NB6+5Wc/7UWobAiOMnu

    Score
    10/10
    formbookh0gdratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks