Overview

overview

10

Static

static

3

e9c5234672...18.exe

windows7-x64

10

e9c5234672...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    e9c5234672c791846a076210769b9c87_JaffaCakes118
  • Size 734KB
  • Sample240409-mc1apsfh3t
  • SHA256 95fa5bac570a78d55bc2494fbacdbf3d38402df53894c5c321db7f3d33639e1c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookbzbrratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • bzbr

Decoy

  • kingtton.com

  • j2task.com

  • richlitforkids.com

  • momentum-avocats.com

  • deddycamp.com

  • ovcelectrical.com

  • tbomed.com

  • riseofgenius.com

  • ctoimpact.com

  • wiki-u.com

  • konbitenterprise.com

  • yfhzpc.com

  • nilsoni.com

  • exoticgoldmines.com

  • cqmyn.com

  • deonbad.com

  • wheyproteines.com

  • nevadamidwives.info

  • hkxs99.com

  • goindiz.com

Targets

    • Target
      e9c5234672c791846a076210769b9c87_JaffaCakes118
    • Size 734KB
    • SHA256 95fa5bac570a78d55bc2494fbacdbf3d38402df53894c5c321db7f3d33639e1c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookbzbrratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks