Overview

overview

10

Static

static

3

PO_101&102.exe

windows7-x64

10

PO_101&102.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_b9fd8df695457466649ea4bc0afc850b4fb6f2c3f365eb633036d66fb88f18f3

  • Size

    453KB

  • Sample

    241221-x52dksxncl

  • MD5

    0ffafd608e2550a687683d47c734c6e1

  • SHA1

    15c98f481ce9134593457f870760d9ddf6ab6039

  • SHA256

    b9fd8df695457466649ea4bc0afc850b4fb6f2c3f365eb633036d66fb88f18f3

  • SHA512

    92ce97d463f8c92e76f82a1ad604a941e34c7d4167932b4ac648ad482ad1458effe2f3cf0280c62b60820831b3657cb55bb0555ee61fd5a5102408cdcefaf59c

  • SSDEEP

    12288:NptNDD7t5gx2+DyykZ85+u7Q1Ihdj3se4Wz:xNvp5go+YAv6YdjSWz

Score
10/10
formbooksnr6discoveryratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

snr6

Decoy

jjglassmi1.com

vpsseattle.com

drfllc.top

staycoolonline.com

eptlove.com

solusimatasehat.site

ionrarecharlestonproperties.com

b3eflucg.xyz

tvchosun-usa.com

mmahzxwzsadqlshop.life

gospelimport.com

demoapps.website

jackburst54.com

99rocket.education

ccbwithbri.com

trapperairsoft.com

useroadly.com

ralphlaurenonline-nl.com

loanmaster4u.com

champ-beauty-tomigaoka-nail.com

Targets

    • Target

      PO_101&102.exe

    • Size

      668KB

    • MD5

      c8a5346cb632c91e0006252fd2c47bec

    • SHA1

      a671570c31428ebc9bee30c9a2b9963bf629560a

    • SHA256

      46a0a8595dccf134213c2e9ae10dd6fdd8e3ff5f0cb1b01014a6b67e31927eec

    • SHA512

      eb3f2e70339e04821b86ced686a47abec277f59a0f90d03b512d6023d71d24de0ae84c36983291d40ecbb4765b94d146affea45b8d09d0d000633af20cfdf528

    • SSDEEP

      12288:fhwV/8FumO5ZBLbGZ3EEFdmgTSuAReaSA7hqJFTP:fmV/8FumO/B3GtnmRufo7hq

    Score
    10/10
    formbooksnr6discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook family

      formbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks