Overview

overview

10

Static

static

3

a40d9c6f96...18.exe

windows7-x64

10

a40d9c6f96...18.exe

windows10-2004-x64

7

$PLUGINSDI...mc.dll

windows7-x64

10

$PLUGINSDI...mc.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a40d9c6f964664b6b5a3ec4ed532df6c_JaffaCakes118

  • Size

    416KB

  • Sample

    240403-xnxdashg4w

  • MD5

    a40d9c6f964664b6b5a3ec4ed532df6c

  • SHA1

    4c1b1a2a6610c2f262c41112364e6629d11eb7f9

  • SHA256

    2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea

  • SHA512

    be4f84af50a13e4527d0da3c4ec91aae2ea2ee52e40066699fae1a11265f734d21c84b59c6ab58219014755c33ceb1b92ff13580b09b475644b40673231652b6

  • SSDEEP

    6144:b8LxBmfthdCKymIlPmoekhHPeFHG9zp6iON4xm7pgXu9CiCIN9X/:9dbyZhRRPeFm99A4g7pg6Dl7

Score
10/10
formbookdn7rratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Targets

    • Target

      a40d9c6f964664b6b5a3ec4ed532df6c_JaffaCakes118

    • Size

      416KB

    • MD5

      a40d9c6f964664b6b5a3ec4ed532df6c

    • SHA1

      4c1b1a2a6610c2f262c41112364e6629d11eb7f9

    • SHA256

      2b1539eebb7c85895026ddcd1e0b062c0d9783d90c7f86236f64f42c2e8d81ea

    • SHA512

      be4f84af50a13e4527d0da3c4ec91aae2ea2ee52e40066699fae1a11265f734d21c84b59c6ab58219014755c33ceb1b92ff13580b09b475644b40673231652b6

    • SSDEEP

      6144:b8LxBmfthdCKymIlPmoekhHPeFHG9zp6iON4xm7pgXu9CiCIN9X/:9dbyZhRRPeFm99A4g7pg6Dl7

    Score
    10/10
    formbookdn7rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/xztemc.dll

    • Size

      27KB

    • MD5

      9c1dba61231005537c4154af2d66b50a

    • SHA1

      8a51892b643ace4c1a99b45e5b03df795b8bb984

    • SHA256

      4f46b2449a7bd7a664b9328f240fc3bfa522e36918a0b672bec3015761d0b67d

    • SHA512

      cd2fbf5b0a67885cd20dfb2fda999c0d9136d34e3c90745d39acf54a5bcf943e8eeb9ea9a53aa179f10aebec84e360582bdaa81604b879a05ef20813533c0ab7

    • SSDEEP

      768:GoFOzbc9RWl6YbFbzdAk3anbI3WkRM3YUUx/e1Mi4:hUbUWlJaUac03Yb/yH4

    Score
    10/10
    formbookdn7rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Tasks