Overview

overview

10

Static

static

3

IMG_20220926_0001.exe

windows7-x64

10

IMG_20220926_0001.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_8ce4ad58214062caff58e6bdee836024c7dba4c3c73d47fd66d96930be15de1d

  • Size

    634KB

  • Sample

    241229-qr76mssngs

  • MD5

    a17d9fa324fd370c8d326b7fed0a0fab

  • SHA1

    9f9a0269c57bb8dfce05af2b65539498e7d1b4d7

  • SHA256

    8ce4ad58214062caff58e6bdee836024c7dba4c3c73d47fd66d96930be15de1d

  • SHA512

    94dd22d19c8a5c6e7fe7f6e8e1f5ad76c8614bbb62a5515e7a14e27ddd1d1cf7b8d2619d6a13128d05005fb42b06ef7f10de82c399ee503d3d7036d36ea84a6f

  • SSDEEP

    12288:iFrD3MMm2aS+8mnC7xVBc1NR+7I/H4kXOkSwFVpn9SvAE2JhEZGeFAATrizQO5B:idD3M81+F+juHR8kXbdsAE2J2ZGj4uzv

Score
10/10
formbookte04discoveryratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

te04

Decoy

oaif.rest

snapchat25.site

ampenova.online

xn--kj0b57geuvy9e.shop

bravobistro.xyz

meebits-freemint.xyz

namaz.city

tdmanagement.info

ytumz.xyz

industrialized.shop

laviedouceexperience.com

aubolabel.com

semblally.shop

vistlink.makeup

adidaihoka.com

gabrielmanfredi.online

sheka.xyz

bcvn2.club

digitalwebtricks.com

poocoin-app-charts.online

Targets

    • Target

      IMG_20220926_0001.exe

    • Size

      1016KB

    • MD5

      c29ade6cb629271fa32e3ecc97757826

    • SHA1

      7113cc1f08981d89e4038d7159744e39dec08168

    • SHA256

      7a2a46ce8e2392d8f1afc79912f86e540c30f1a8428ec455f14182c0131403ed

    • SHA512

      ade3953e9ceb93875b91ffb77131a2b76a1bf763d34f0c690f44f178c35522bc5cf023671b98c73dca51ebb4ed3844f325cbacaf3ae6882541fbb3b902b7977e

    • SSDEEP

      12288:edBMsHT+oXKSslNvgT5PqdOHQYleaIqHLJnt16K4HTN:yBRz+hOsOweIqrJt1

    Score
    10/10
    formbookte04discoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook family

      formbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks