Overview

overview

10

Static

static

3

e8cdc455c7...18.exe

windows7-x64

10

e8cdc455c7...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    e8cdc455c726afea65ab6a4b0b45d45c_JaffaCakes118
  • Size 724KB
  • Sample240918-lezxaathqk
  • SHA256 f972763991a3043f1e9cca9c8b0d368d6ff9628bbb21fbe4d7213ffd75a67494
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookpediscoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 3.9

Campaign

  • pe

Decoy

  • blackcatproud.com

  • kddgu.info

  • jhholiday.com

  • woshunwang.com

  • qrvou.info

  • yinuojie.com

  • 404arabs.com

  • diaojieorg.com

  • hsyfjj.com

  • medusabotanicals.com

  • ghay5c.com

  • wm785.com

  • bikeandart.com

  • ygyroadside.info

  • whitewings.biz

  • 4pointpartnersbv.com

  • tukangsedotwc.net

  • democrataward.com

  • systemtraffic2updating.win

  • thevlu.com

Targets

    • Target
      e8cdc455c726afea65ab6a4b0b45d45c_JaffaCakes118
    • Size 724KB
    • SHA256 f972763991a3043f1e9cca9c8b0d368d6ff9628bbb21fbe4d7213ffd75a67494
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookpediscoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks