Overview

overview

10

Static

static

3

b5f4ecf1a1...18.exe

windows7-x64

10

b5f4ecf1a1...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118
  • Size 525KB
  • Sample240617-arydfavhpc
  • SHA256 157d4620189778ea181eb65ebcba012dc8c7af3a9a9cf3ceb6560daf91df940c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookprivateratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 3.9

Campaign

  • private

Decoy

  • epsilonducts.net

  • stateofpunjab.com

  • followthegirl.com

  • parol2.men

  • hungryforlondon.com

  • comercializadorafqe.com

  • sippinteawithlynnmarie.com

  • qianbi.group

  • tbfuk.com

  • ladybosscbdoil.com

  • reginatowingservices.com

  • avangardmerefa.com

  • rn-structure.com

  • skymansionexpatriate.com

  • eloiseantonie.com

  • leegardenapartmentsbeijing.com

  • selfievideochallenge.com

  • kay-lubcke.com

  • buybitcoininmalta.com

  • pusatgrosirgamismuslimah.com

Targets

    • Target
      b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118
    • Size 525KB
    • SHA256 157d4620189778ea181eb65ebcba012dc8c7af3a9a9cf3ceb6560daf91df940c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookprivateratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks