Overview

overview

10

Static

static

3

ea25c184df...18.exe

windows7-x64

9

ea25c184df...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ea25c184df955f5e4382ce73fe3eb6bb_JaffaCakes118
  • Size 1.1MB
  • Sample240409-rad2xacb8s
  • SHA256 b4932161d592d2b1c33be7ef495b873434ea47f9031e44b31338a041b22394ba
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookgmtrratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • gmtr

Decoy

  • kocnetelgroup.com

  • william-and-alexandra.com

  • overseasdata.com

  • the-wild-wild-east.com

  • analistaweb.net

  • hybridkarts.com

  • secure-apple-ld.com

  • semjasessprx.com

  • ahaa.store

  • 9maskgame.online

  • bellydancer-cicycai.com

  • qy35tc.com

  • immopix.net

  • catarinayamamoto.com

  • binvestcrm.com

  • mycsource.com

  • cookedonpropane.net

  • melmorg.com

  • mattkalita.com

  • animalkitchen.net

Targets

    • Target
      ea25c184df955f5e4382ce73fe3eb6bb_JaffaCakes118
    • Size 1.1MB
    • SHA256 b4932161d592d2b1c33be7ef495b873434ea47f9031e44b31338a041b22394ba
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookgmtrratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks