Overview

overview

10

Static

static

3

INCENTIVE.exe

windows7-x64

10

INCENTIVE.exe

windows10-2004-x64

7

$PLUGINSDI...gm.dll

windows7-x64

3

$PLUGINSDI...gm.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    JaffaCakes118_9d4bfc8d1d35b095e4989c7a6a9a5eae41521eb64c751f9f13cff76ec0bcf1eb
  • Size 418KB
  • Sample241230-bthlfatkfp
  • SHA256 9d4bfc8d1d35b095e4989c7a6a9a5eae41521eb64c751f9f13cff76ec0bcf1eb
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookn62sdiscoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • n62s

Decoy

  • renabic.com

  • thesanaservice.xyz

  • lifemadegood.com

  • lovedowlin.com

  • dobro46.online

  • birotoafyon.com

  • haztol.xyz

  • 917mainstreet.com

  • letshelpourselves.website

  • mysticalbloodmoon.com

  • legallyblondeattorney.com

  • metagoldenstate.com

  • ylhsklzjs.com

  • thejupitercraft.com

  • josephineclaimhelp.com

  • flowstorellc.com

  • eyeofthegate.com

  • asahi1500.com

  • ochumare.com

  • hieslerpark.com

Targets

    • Target
      INCENTIVE.exe
    • Size 435KB
    • SHA256 d30c25033a8cd080bc76463ad1ef591f61b66b5bf36aae6557d9664714908614
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookn62sdiscoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook family

      formbook

    • Formbook payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/wslelgm.dll
    • Size 303KB
    • SHA256 fcb8bd3b27beffa5255fbc8b485b038b321043eecd77fc21cf4798446c21a971
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks