Overview

overview

10

Static

static

3

e6aaadae7c...18.exe

windows7-x64

9

e6aaadae7c...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    e6aaadae7c2be3a8f486e8f439c05796_JaffaCakes118
  • Size 1.3MB
  • Sample240408-ffnyhsha75
  • SHA256 530f994d0a6cd6632799de5eae17e4cc8b7a522766baec98a871d9611884abba
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookbcakratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • bcak

Decoy

  • shizixiudian.com

  • thetimemerchants.com

  • rafflere.com

  • amosiagongbang.com

  • pikantepikariko.com

  • nationaltodaytv.com

  • anjielo.net

  • atlerz.com

  • cloudteamthree.com

  • cafelegume.com

  • gvniypqiy.icu

  • xn--schuldenzsurgesetz-ttb.info

  • jlxrcm.com

  • flowcraftnetworks.com

  • viberiokno-online.com

  • guisese66.com

  • farmaciaavicena.com

  • sealedgamescompany.com

  • eastonwestinc.com

  • szwmsz.com

Targets

    • Target
      e6aaadae7c2be3a8f486e8f439c05796_JaffaCakes118
    • Size 1.3MB
    • SHA256 530f994d0a6cd6632799de5eae17e4cc8b7a522766baec98a871d9611884abba
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookbcakratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks