Overview

overview

10

Static

static

3

55b4851579...18.exe

windows7-x64

10

55b4851579...18.exe

windows10-2004-x64

7

$PLUGINSDI...rh.dll

windows7-x64

10

$PLUGINSDI...rh.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    55b4851579613a15a12a14948cabce4f_JaffaCakes118

  • Size

    412KB

  • Sample

    240331-qrnr1ada94

  • MD5

    55b4851579613a15a12a14948cabce4f

  • SHA1

    f6a02a7c3877eb5fa57aec80d477c4e093ad8b92

  • SHA256

    6b1be3797db71ce042abc0bc3586bb84091084d3a104561a2f0440d8031d35b0

  • SHA512

    fa282a3f3bbf33849075329e2850b58eace6dfebc2b7b3b78fbba5de2359cbd77873e721df94c051c5c3ec1ba2852fcbdb6220fb4e0597b3a9768382e84b3a70

  • SSDEEP

    6144:hBlL/8rwu/O7DNEc5yEDlQFswC4HDYmwDAejmStOyqFWOykkEtTJNr:nvEc5lhQFJC4HDYrdjpbGKMzr

Score
10/10
formbookdn7rratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Targets

    • Target

      55b4851579613a15a12a14948cabce4f_JaffaCakes118

    • Size

      412KB

    • MD5

      55b4851579613a15a12a14948cabce4f

    • SHA1

      f6a02a7c3877eb5fa57aec80d477c4e093ad8b92

    • SHA256

      6b1be3797db71ce042abc0bc3586bb84091084d3a104561a2f0440d8031d35b0

    • SHA512

      fa282a3f3bbf33849075329e2850b58eace6dfebc2b7b3b78fbba5de2359cbd77873e721df94c051c5c3ec1ba2852fcbdb6220fb4e0597b3a9768382e84b3a70

    • SSDEEP

      6144:hBlL/8rwu/O7DNEc5yEDlQFswC4HDYmwDAejmStOyqFWOykkEtTJNr:nvEc5lhQFJC4HDYrdjpbGKMzr

    Score
    10/10
    formbookdn7rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/nxxdjcrh.dll

    • Size

      32KB

    • MD5

      c03c5de8c641f55c6125c0af2f0b4bfb

    • SHA1

      9175d78cbc6b4b0bfdeff2c59a43a8330130eb30

    • SHA256

      838a4922f935bfe7908f6d5ecf315d90d40dd2f4efc8e35067b960574bc89043

    • SHA512

      6a6e3e15e349fb8197f2b15013d32224dc28e00c0ca70804754c37ff782f42df40b7d9b724ded522399870a01ec32e7eb3a72f5566d2f604bb6a4e482c955e31

    • SSDEEP

      768:GRUkuBuiKTp5AU+rY7b1Q9CagzynKkDEX:aTAWy9c+DW

    Score
    10/10
    formbookdn7rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Tasks