Overview

overview

10

Static

static

3

d7f1300dd4...18.exe

windows7-x64

10

d7f1300dd4...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    d7f1300dd4f56d7b8e698e94af817056_JaffaCakes118
  • Size 557KB
  • Sample240405-s8b6msge62
  • SHA256 c4edf97ee108849df46eadbc7984bf178d0da690d9825adc7b7cdac465d12605
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookjw9uratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • jw9u

Decoy

  • myhvacdeal.com

  • therizks2022.com

  • belondo.com

  • selflovewithallie.com

  • fkdosdz3.xyz

  • 2commacluboffers.com

  • beyazyakaetkinlik.com

  • 5sensesbranding.com

  • clesioalves.com

  • home2.xyz

  • talulaboutique.com

  • marketing-republic.com

  • mappilog.com

  • n1a.site

  • berlinspecials.com

  • iphone13.media

  • healthrapidlab.com

  • outdoorteakgarden.com

  • i0bqd8ny.xyz

  • chairzon.com

Targets

    • Target
      d7f1300dd4f56d7b8e698e94af817056_JaffaCakes118
    • Size 557KB
    • SHA256 c4edf97ee108849df46eadbc7984bf178d0da690d9825adc7b7cdac465d12605
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookjw9uratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks