Overview

overview

10

Static

static

3

ebee31991b...18.exe

windows7-x64

1

ebee31991b...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ebee31991b156db114ab560139198d8f_JaffaCakes118
  • Size 791KB
  • Sample240410-zbph2aea2x
  • SHA256 3334766a549149bb18921ea6d05343412c99d36b57e3993b7610dfe689f5f194
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookglgdagilenetratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • glgd

Decoy

  • cdcbullies.com

  • qidajixie.com

  • bgimlv.com

  • sunflowerhybrid.com

  • kemal.cloud

  • canadadirect.net

  • mickey2nd.com

  • fastjobssearcher.com

  • tiny-tobi.com

  • inmedixequus.com

  • coollifeideas.com

  • triadelectronicsupply.com

  • lambyo.com

  • zxyoo.com

  • spokanemusicmag.com

  • sortporn.com

  • deadroomnyc.com

  • 313mail.com

  • hexiptv.net

  • stanbiccargo-express.com

Targets

    • Target
      ebee31991b156db114ab560139198d8f_JaffaCakes118
    • Size 791KB
    • SHA256 3334766a549149bb18921ea6d05343412c99d36b57e3993b7610dfe689f5f194
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookglgdagilenetratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks