Overview

overview

10

Static

static

3

bfb2b5d001...18.exe

windows7-x64

10

bfb2b5d001...18.exe

windows10-2004-x64

10

$PLUGINSDI...go.dll

windows7-x64

10

$PLUGINSDI...go.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bfb2b5d00165cb4984c29c172e0dad8d_JaffaCakes118

  • Size

    250KB

  • Sample

    240404-w7wqfafe85

  • MD5

    bfb2b5d00165cb4984c29c172e0dad8d

  • SHA1

    e5baa4cfe4b0ec678910e94fc8785fd28605bb6b

  • SHA256

    e6aaec2b958d4b734ff02c7c63b7e24a619eef826efb16b955ebe5306b9953aa

  • SHA512

    d0d20eda540283ead0b873c27f047c7f433c4f85e1a8b890c8c4ef7daeebc91c691c2aad59de1eccca26cc8748ba123f55200a183dd7a1421f98dbd264e96815

  • SSDEEP

    6144:wBlL/celgJ3+QZizYdH9vPQI5pQpxL5T/Fo9RooX/:Ceem9AzQH14I5pQnm/

Score
10/10
formbookrv9nratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rv9n

Decoy

olivia-grace.show

zhuwww.com

keiretsu.xyz

olidnh.space

searuleansec.com

2fastrepair.com

brooklynmetalroof.com

scodol.com

novaprint.pro

the-loaner.com

nextroundscap.com

zbwlggs.com

internetautodealer.com

xn--tornrealestate-ekb.com

yunjiuhuo.com

skandinaviskakryptobanken.com

coxivarag.rest

ophthalmologylab.com

zzzzgjcdbqnn98.net

doeful.com

Targets

    • Target

      bfb2b5d00165cb4984c29c172e0dad8d_JaffaCakes118

    • Size

      250KB

    • MD5

      bfb2b5d00165cb4984c29c172e0dad8d

    • SHA1

      e5baa4cfe4b0ec678910e94fc8785fd28605bb6b

    • SHA256

      e6aaec2b958d4b734ff02c7c63b7e24a619eef826efb16b955ebe5306b9953aa

    • SHA512

      d0d20eda540283ead0b873c27f047c7f433c4f85e1a8b890c8c4ef7daeebc91c691c2aad59de1eccca26cc8748ba123f55200a183dd7a1421f98dbd264e96815

    • SSDEEP

      6144:wBlL/celgJ3+QZizYdH9vPQI5pQpxL5T/Fo9RooX/:Ceem9AzQH14I5pQnm/

    Score
    10/10
    formbookrv9nratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/irjzbmbgo.dll

    • Size

      29KB

    • MD5

      3525f0279729cb34e886c8a83b5ce9c8

    • SHA1

      b6edfeff839616e0155026cabed1e48de96a9063

    • SHA256

      082c9b72407d063bb96c2830bcaf5f285d2d616e8a8d729a52b39ccbd30b8211

    • SHA512

      2c74fc1a977204adb58a1af19850fa705716ca5c9b1d42f2b0d84dfe14a2e5c6af5f9e158b4cc132c1874de3b67cdd422cfc00e0dad63982718d5d0ce5f31f55

    • SSDEEP

      768:JGpszi/8+qQSH3j623iROMappKGGgmPq5TN:FzlNQSH3j623iNaKyf5

    Score
    10/10
    formbookrv9nratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Tasks