Overview

overview

10

Static

static

3

f632a24416...18.exe

windows7-x64

10

f632a24416...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f632a2441686827d3de393b79f3722a3_JaffaCakes118
  • Size 303KB
  • Sample240925-rmtywszdpl
  • SHA256 44e4fb6e15fab6a1185c6687df614d6fdef232879ccb1f8be9c811ece57b2682
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookhx319discoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 3.8

Campaign

  • hx319

Decoy

  • dcxinc.biz

  • synergiescorpsesprit.com

  • opvca.com

  • 7907f.com

  • hunch.info

  • gxysdc.com

  • khu6.com

  • zimmer-ulm.com

  • bodyfacial.com

  • shanoski.net

  • hellcase.market

  • usdragonz.com

  • ecologisticperu.com

  • bitliga.net

  • iddaocc.com

  • houstoncarrelief.com

  • thetravelists.com

  • excellcium-promotion.com

  • brendenguthrie.com

  • cooperateget.com

Targets

    • Target
      f632a2441686827d3de393b79f3722a3_JaffaCakes118
    • Size 303KB
    • SHA256 44e4fb6e15fab6a1185c6687df614d6fdef232879ccb1f8be9c811ece57b2682
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookhx319discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks