Overview

overview

10

Static

static

3

489e2e06c4...18.exe

windows7-x64

10

489e2e06c4...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    489e2e06c46ad8f2a7269a677904026f_JaffaCakes118
  • Size 498KB
  • Sample240331-a1bk2aae3z
  • SHA256 f9bd74fdfb667569270dfaa42017873aed84149a633cf3fa97e8db1142bd5edd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookhht8ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • hht8

Decoy

  • chenghuaikj.com

  • lovegames.site

  • namalon.com

  • ltxxiu.com

  • yaotiaoshiguang.top

  • serversshipping.com

  • animationwageshare.com

  • rh-et.com

  • cutepets1.com

  • chantforpeace.com

  • techmazakatta.com

  • amoorelive.com

  • bisexualnft.com

  • k5truckingexpress.com

  • 6e1eturzmu9ustbnrfe2404.com

  • allday.coach

  • prettyrisque.com

  • stripeer.com

  • ktranspass.com

  • salinibros.com

Targets

    • Target
      489e2e06c46ad8f2a7269a677904026f_JaffaCakes118
    • Size 498KB
    • SHA256 f9bd74fdfb667569270dfaa42017873aed84149a633cf3fa97e8db1142bd5edd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookhht8ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks