Overview

overview

10

Static

static

3

b16bb2a4fe...18.exe

windows7-x64

10

b16bb2a4fe...18.exe

windows10-2004-x64

7

$PLUGINSDI...pg.dll

windows7-x64

10

$PLUGINSDI...pg.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b16bb2a4fe3ee1b986926530169eeb44_JaffaCakes118

  • Size

    252KB

  • Sample

    240404-gh1krsgc4x

  • MD5

    b16bb2a4fe3ee1b986926530169eeb44

  • SHA1

    b4c9eb0cc26a50743d51ee56ea7639a64f43dafa

  • SHA256

    336a2648e0811ebd11a94bb59c5cd5ea06ff48485f734ce149a3f9f9a7e0c7f4

  • SHA512

    2c5e2ff040d22683dfd4b366048f21db8e8f9c9ef636501a73539ac92b61d60818aa049ba265080275151b8f7cb317b68dfd9e4ff9777c867eac20fd8f798d68

  • SSDEEP

    6144:wBlL/cbqbPtCEx551/DXhD22qittuP9cg3LNR5gL:CebqbPtNhVDRDyxa

Score
10/10
formbookdn7rratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Targets

    • Target

      b16bb2a4fe3ee1b986926530169eeb44_JaffaCakes118

    • Size

      252KB

    • MD5

      b16bb2a4fe3ee1b986926530169eeb44

    • SHA1

      b4c9eb0cc26a50743d51ee56ea7639a64f43dafa

    • SHA256

      336a2648e0811ebd11a94bb59c5cd5ea06ff48485f734ce149a3f9f9a7e0c7f4

    • SHA512

      2c5e2ff040d22683dfd4b366048f21db8e8f9c9ef636501a73539ac92b61d60818aa049ba265080275151b8f7cb317b68dfd9e4ff9777c867eac20fd8f798d68

    • SSDEEP

      6144:wBlL/cbqbPtCEx551/DXhD22qittuP9cg3LNR5gL:CebqbPtNhVDRDyxa

    Score
    10/10
    formbookdn7rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/pibyjvpg.dll

    • Size

      31KB

    • MD5

      7e38c9c4dae24727bfc89d6feba8cb3e

    • SHA1

      53500d0d0b8921fe6690dbdd2009be6d9c06adc6

    • SHA256

      087ed293380602e60c32df98be8412bd73d32beba232bc255a6fb3edf46134ff

    • SHA512

      835412fa1c001a1ec811a51be9afc361cea9ec8db8a85912bf7007b20f74b338323b59ac637a1cfc9afebdf57c6a441680c0707d15c13c7560eaacc94a56a985

    • SSDEEP

      768:ZMFszi/lKK6Q4JEdfK2lbdsQ5ZpTIPvATh:/zyKxQ4JEdfK2lbxLpTkA

    Score
    10/10
    formbookdn7rratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Tasks