Overview

overview

10

Static

static

3

28adf2e4dc...18.exe

windows7-x64

10

28adf2e4dc...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118
  • Size 480KB
  • Sample240509-g29msagh93
  • SHA256 532b875f09991cdf7b57db59f0f7aa579d49b229d65ad1ace9f67bf6ffc7bca5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookcbsxxratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • cbsxx

Decoy

  • i3w46yd-e8p36.com

  • vikingworrier.com

  • ytsunyea.com

  • staceyandkevin.com

  • vanwheel.com

  • insurancenashvillegeorgia.com

  • ikumou-pro.com

  • motivacaodigital.com

  • beypk.com

  • tekyildizgroup.com

  • nguyentruongphi.com

  • impalagoldcollective.com

  • uknus.net

  • xn--cjrz24b9ma835a.com

  • militaryeducations.com

  • hcszyz.com

  • frymanswelding.com

  • 064415.com

  • lianyunbi.com

  • fishofthenet.com

Targets

    • Target
      28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118
    • Size 480KB
    • SHA256 532b875f09991cdf7b57db59f0f7aa579d49b229d65ad1ace9f67bf6ffc7bca5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookcbsxxratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks