Overview

overview

10

Static

static

3

49c8f6c2c3...18.exe

windows7-x64

10

49c8f6c2c3...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    49c8f6c2c3906190a4a37b80fab5da5b_JaffaCakes118
  • Size 476KB
  • Sample240331-b4emjaca74
  • SHA256 bc27791cfd964022a456b60694bf22360192d2abcb94ec729568ea27bb72c594
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooks2wtratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • s2wt

Decoy

  • yukiyamaapperal.com

  • rumasultan.store

  • japaese.com

  • quangphatloi.com

  • 148atk.xyz

  • myheatstore.online

  • theedeneconomy.com

  • 5xssc1.icu

  • krakensistem.xyz

  • gwangyo.com

  • lj-safe-keepingkokoka6.xyz

  • naturetheaterofoklahoma.com

  • perayaanwisudaitb.com

  • hrbsxxf.com

  • allencountypallet.com

  • vizit-app.com

  • startstartnow.com

  • inviertechile.com

  • haysneedlepotracks.com

  • cfdbestbroker.online

Targets

    • Target
      49c8f6c2c3906190a4a37b80fab5da5b_JaffaCakes118
    • Size 476KB
    • SHA256 bc27791cfd964022a456b60694bf22360192d2abcb94ec729568ea27bb72c594
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooks2wtratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks