Overview

overview

10

Static

static

3

97d698a245...18.exe

windows7-x64

10

97d698a245...18.exe

windows10-2004-x64

7

$PLUGINSDIR/offyp.dll

windows7-x64

10

$PLUGINSDIR/offyp.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    97d698a2454cb6675dad12033500c17f_JaffaCakes118

  • Size

    253KB

  • Sample

    240402-1hnqraec41

  • MD5

    97d698a2454cb6675dad12033500c17f

  • SHA1

    5b3e3f25bf30fb6a34143455623e270438ac48c2

  • SHA256

    359ecb05de93b2ccc31cc15d249ef69a564d2f2e63d925126a6d784ef224766b

  • SHA512

    48bb9fc9d8620127cf89e95b0c6787d3e48acb9cdbbe9e766c4dbc4c340ce9e05e8f2b17a8e43eabc492363e8a097607c92110e12da74f8ae2df0d0819bd7b1c

  • SSDEEP

    6144:wBlL/cgg+QPHCAgKAa/3x40OCqHbbmHYoeVo0kr5B8+V7UC72By0Bu:CeYNzIPcbKHYoe+0cDW17u

Score
10/10
formbookdn7rratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Targets

    • Target

      97d698a2454cb6675dad12033500c17f_JaffaCakes118

    • Size

      253KB

    • MD5

      97d698a2454cb6675dad12033500c17f

    • SHA1

      5b3e3f25bf30fb6a34143455623e270438ac48c2

    • SHA256

      359ecb05de93b2ccc31cc15d249ef69a564d2f2e63d925126a6d784ef224766b

    • SHA512

      48bb9fc9d8620127cf89e95b0c6787d3e48acb9cdbbe9e766c4dbc4c340ce9e05e8f2b17a8e43eabc492363e8a097607c92110e12da74f8ae2df0d0819bd7b1c

    • SSDEEP

      6144:wBlL/cgg+QPHCAgKAa/3x40OCqHbbmHYoeVo0kr5B8+V7UC72By0Bu:CeYNzIPcbKHYoe+0cDW17u

    Score
    10/10
    formbookdn7rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/offyp.dll

    • Size

      31KB

    • MD5

      367abec7270d4919121d630ad1e9359a

    • SHA1

      f9508697941b1619541babd95744abeb1b0ce6f5

    • SHA256

      8154494ad395ee4638b8990a47a3d163452514f6b45ee71919445ba1cff60099

    • SHA512

      9fa6db19991df3bac0d97176f1cf14db0ed67c3b1d2276ebecaf7f7dab2c1cfe2e9db5820fd708a61312b57d4727805c7481b030e94837d6a9e9365d4a1f0638

    • SSDEEP

      384:sU8zf4ugCCZaQRgde6AMswci/+9YFsDWoQaZb4F+JQF2NWHZD246L8dCebjPq12H:H6qMszi/qKoQe4MJQF2YMvVI71TV

    Score
    10/10
    formbookdn7rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Tasks