Overview

overview

10

Static

static

3

03d6a18a55...18.exe

windows7-x64

10

03d6a18a55...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    03d6a18a555baf86856a5a175f9c5fd1_JaffaCakes118
  • Size 322KB
  • Sample240427-25bkdaaf55
  • SHA256 8abcc938aa54e577deda50c0e49029a71d4acff145457b957dcb2620dbf8845c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookrlratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 3.9

Campaign

  • rl

Decoy

  • seguin-aurillac.com

  • 108manbetx.com

  • abbeysbeat.com

  • olerne.com

  • hotelresortsupplier.com

  • tile-machines.com

  • o2tourist.com

  • ruidadp.com

  • hempfour.life

  • cdnhf.com

  • vivacleaningservices.com

  • mountaintravelagency.com

  • bohniverse-ladungssicherung.com

  • cfuzvs.info

  • musiclave.com

  • jiexingxidi.com

  • tonaro.net

  • gulfvatsolution.info

  • tissotcapital.com

  • expertcatcare.com

Targets

    • Target
      03d6a18a555baf86856a5a175f9c5fd1_JaffaCakes118
    • Size 322KB
    • SHA256 8abcc938aa54e577deda50c0e49029a71d4acff145457b957dcb2620dbf8845c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookrlratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks