Overview

overview

10

Static

static

3

38694cf4cf...18.exe

windows7-x64

10

38694cf4cf...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    38694cf4cf60fc8408f11b40e2e62338_JaffaCakes118
  • Size 737KB
  • Sample240729-e6f5xstcjk
  • SHA256 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookbncdiscoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • bnc

Decoy

  • iseoguide.com

  • rogerellisonline.com

  • thephonelenses.com

  • reddystone.com

  • explorehokianga.com

  • miaflcio.vote

  • baonihaochi.com

  • thewiseengineer.com

  • exciplexinc.com

  • luewaeeqaredre.com

  • atharvatechnologysolutions.com

  • vnsr1234.com

  • nationswines.com

  • toaglobalcc.com

  • texasbusrental.com

  • sailfishingcostarica.com

  • superbuy.today

  • mode-paradox.com

  • soperlz.xyz

  • filterdance.com

Targets

    • Target
      38694cf4cf60fc8408f11b40e2e62338_JaffaCakes118
    • Size 737KB
    • SHA256 2c5f5dbeb72dc0832f94f4ad3bfe984ac1e8a9dd6b64a4335394cfc16ee00a6a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookbncdiscoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks