Overview

overview

10

Static

static

3

40c9037d2d...18.exe

windows7-x64

10

40c9037d2d...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    40c9037d2d9cf0ccfd3e4761b732c173_JaffaCakes118
  • Size 557KB
  • Sample240330-wctmlaah7t
  • SHA256 4a028b7f272dd96c75716d2268b551576a01ebccaca97bb19da43ec21dbe8514
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooked9sratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • ed9s

Decoy

  • pocketoptioniraq.com

  • merabestsolutions.com

  • atelectronics.site

  • fuxueshi.net

  • infinitystay.com

  • forensicconcept.site

  • txpmachine.com

  • masterwhs.xyz

  • dia-gnwsis.art

  • fulltiltnodes.com

  • bigbnbbsc.com

  • formation-figma.com

  • bonanacroin.net

  • medicalmarijuanasatx.com

  • bagnavy.com

  • aaegiscares.net

  • presentationpublicschool.com

  • bestyousite.site

  • prescriptionn.com

  • beyondthenormbouquets.com

Targets

    • Target
      40c9037d2d9cf0ccfd3e4761b732c173_JaffaCakes118
    • Size 557KB
    • SHA256 4a028b7f272dd96c75716d2268b551576a01ebccaca97bb19da43ec21dbe8514
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooked9sratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks