Overview

overview

10

Static

static

3

9eeccc9b58...18.exe

windows7-x64

10

9eeccc9b58...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9eeccc9b585e1ffdf53b20b3d4f4505d_JaffaCakes118
  • Size 519KB
  • Sample240403-d2dnkaef7z
  • SHA256 3c002d7d7bfb83b56c94765d3f1cd9182993dabe4442e8f506fbe76334a01995
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbooks6tnratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • s6tn

Decoy

  • ya-volna.com

  • nakimura.online

  • buildtheyamato.com

  • carecard.xyz

  • orthozayn.com

  • sitd.xyz

  • garu.club

  • alfainfocom.com

  • floridalacrossecamps.com

  • banytus.xyz

  • dogodipiskot.quest

  • ljlsaf.com

  • shaheenricemills.com

  • cuevieujni.info

  • chrisandkcollection.com

  • sunadokei.website

  • hoidotsbirky.quest

  • creditassociatesllc.com

  • amazonhrjobs.com

  • the-luggage-dropp-off.com

Targets

    • Target
      9eeccc9b585e1ffdf53b20b3d4f4505d_JaffaCakes118
    • Size 519KB
    • SHA256 3c002d7d7bfb83b56c94765d3f1cd9182993dabe4442e8f506fbe76334a01995
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbooks6tnratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks