Overview

overview

10

Static

static

3

918fe5ceae...18.exe

windows7-x64

10

918fe5ceae...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    918fe5ceae3805d873b0380be3f99410_JaffaCakes118
  • Size 424KB
  • Sample240603-m856tscc9t
  • SHA256 81e810a8629368aff2b37cd70c894140ea98fe5d701262885b423a5c8482e213
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookh313ratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 3.8

Campaign

  • h313

Decoy

  • kudaspb.info

  • riven.market

  • strictlyafricanjapan.win

  • moresisebank.com

  • lugg14141.com

  • musictravelbar.com

  • snip-store.net

  • mnum2.com

  • inevitably.ltd

  • topskin-care.live

  • chinasmokingglass.com

  • milkmuuske.com

  • gadology.com

  • lntoken.com

  • wxtusugangguan.com

  • freetraffic2upgradeall.review

  • myhumblenode.com

  • otodo.site

  • ryden-mckenna-ltd.com

  • diminishedunison.com

Targets

    • Target
      918fe5ceae3805d873b0380be3f99410_JaffaCakes118
    • Size 424KB
    • SHA256 81e810a8629368aff2b37cd70c894140ea98fe5d701262885b423a5c8482e213
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookh313ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks