Overview

overview

10

Static

static

3

9f95195d65...18.exe

windows7-x64

10

9f95195d65...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9f95195d65c34c3b3bc599e399196cbb_JaffaCakes118
  • Size 460KB
  • Sample240403-el8pfafe4s
  • SHA256 efbfd17d24ef5ee8e54a74ef9527396d511bcdade1826a1c08ee4f2603ec798e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookusebratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • useb

Decoy

  • houseofbooksae.net

  • ipjfeugo.xyz

  • sandiegowavefc.store

  • kamerynemehiel.com

  • herbalhealthalert.com

  • nfmedco.com

  • dorhop.com

  • bookingscenter.com

  • blaclyteproductions.com

  • novatel-network.com

  • locomotionprogramming.com

  • dotchocolatebars.com

  • rohanyat.online

  • a2detail.com

  • cotedazurpropertyforsale.com

  • space-vantage.space

  • averysanswers.com

  • lionheartimagery.com

  • nozincwadi.com

  • lovemyduck.com

Targets

    • Target
      9f95195d65c34c3b3bc599e399196cbb_JaffaCakes118
    • Size 460KB
    • SHA256 efbfd17d24ef5ee8e54a74ef9527396d511bcdade1826a1c08ee4f2603ec798e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookusebratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks