Overview

overview

10

Static

static

3

108156ae36...18.exe

windows7-x64

10

108156ae36...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    108156ae3609706003c6cefd6335c554_JaffaCakes118
  • Size 368KB
  • Sample240503-pjadzagc36
  • SHA256 535d92c4a194c64723fdf9b7279f033085c0861d93b9f43747320759fd172afc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookjcratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 3.9

Campaign

  • jc

Decoy

  • petfashionvalley.com

  • sisermexico.com

  • mycityneighbors.com

  • trojanerhilfe.com

  • 2012mi.com

  • bitcoinkeith.com

  • integracube.com

  • portalgnu.com

  • xingcaiyule2.com

  • saasgroceries.com

  • groupulljimzasac.com

  • sscfz.win

  • microauditoria.com

  • grandijen.com

  • beautiebootik.com

  • trb899.com

  • autobittrex.com

  • greeksinbritain.com

  • flamingouno.com

  • agencecuivre.com

Targets

    • Target
      108156ae3609706003c6cefd6335c554_JaffaCakes118
    • Size 368KB
    • SHA256 535d92c4a194c64723fdf9b7279f033085c0861d93b9f43747320759fd172afc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookjcratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks