Overview

overview

10

Static

static

3

IMG_20220926_0001.exe

windows7-x64

10

IMG_20220926_0001.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6c08374e5bb8821e6fc39a118acea4f600cd0cee55b8855d885cba6811c96468

  • Size

    634KB

  • Sample

    241224-y2fhdawpcn

  • MD5

    279aaecc15f61a495d9bd214004f569f

  • SHA1

    b20a7dac5ab62f4778eaa3a887a708ac66953bc9

  • SHA256

    6c08374e5bb8821e6fc39a118acea4f600cd0cee55b8855d885cba6811c96468

  • SHA512

    bb96c7bde634151110dde2f7a64e967cf0eee7e92e2125da46888240605ed88f13ec772d5657a31c00d9ba4a4be82a722f00979f001950e3c161c8ec7a67d3c1

  • SSDEEP

    12288:Xt83KNtkrL519HBd8HCsgoTw1PvdKevSsfc/0V7eKD6/7WGyJLSV9v6kdk4GQX8P:Xq3KNtkrL1HBd8Htc13YeKsCyC/7WXVF

Score
10/10
formbookte04discoveryratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

te04

Decoy

oaif.rest

snapchat25.site

ampenova.online

xn--kj0b57geuvy9e.shop

bravobistro.xyz

meebits-freemint.xyz

namaz.city

tdmanagement.info

ytumz.xyz

industrialized.shop

laviedouceexperience.com

aubolabel.com

semblally.shop

vistlink.makeup

adidaihoka.com

gabrielmanfredi.online

sheka.xyz

bcvn2.club

digitalwebtricks.com

poocoin-app-charts.online

Targets

    • Target

      IMG_20220926_0001.exe

    • Size

      1016KB

    • MD5

      c29ade6cb629271fa32e3ecc97757826

    • SHA1

      7113cc1f08981d89e4038d7159744e39dec08168

    • SHA256

      7a2a46ce8e2392d8f1afc79912f86e540c30f1a8428ec455f14182c0131403ed

    • SHA512

      ade3953e9ceb93875b91ffb77131a2b76a1bf763d34f0c690f44f178c35522bc5cf023671b98c73dca51ebb4ed3844f325cbacaf3ae6882541fbb3b902b7977e

    • SSDEEP

      12288:edBMsHT+oXKSslNvgT5PqdOHQYleaIqHLJnt16K4HTN:yBRz+hOsOweIqrJt1

    Score
    10/10
    formbookte04discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook family

      formbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks