Overview

overview

10

Static

static

3

47f7e7a32e...18.exe

windows7-x64

10

47f7e7a32e...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    47f7e7a32e8ee493383a5381731a6923_JaffaCakes118
  • Size 618KB
  • Sample240331-afvs6shh9t
  • SHA256 4bd4b9f79c629ce5f602b3cc8bacefb6c3779498d66b946be9da734111659f23
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookusebratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • useb

Decoy

  • houseofbooksae.net

  • ipjfeugo.xyz

  • sandiegowavefc.store

  • kamerynemehiel.com

  • herbalhealthalert.com

  • nfmedco.com

  • dorhop.com

  • bookingscenter.com

  • blaclyteproductions.com

  • novatel-network.com

  • locomotionprogramming.com

  • dotchocolatebars.com

  • rohanyat.online

  • a2detail.com

  • cotedazurpropertyforsale.com

  • space-vantage.space

  • averysanswers.com

  • lionheartimagery.com

  • nozincwadi.com

  • lovemyduck.com

Targets

    • Target
      47f7e7a32e8ee493383a5381731a6923_JaffaCakes118
    • Size 618KB
    • SHA256 4bd4b9f79c629ce5f602b3cc8bacefb6c3779498d66b946be9da734111659f23
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookusebratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks