Overview

overview

10

Static

static

3

order list.exe

windows7-x64

10

order list.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4e94655c7c0870f82b0c339638abc3e0

  • Size

    329KB

  • Sample

    250101-knbqdaspgn

  • MD5

    4e94655c7c0870f82b0c339638abc3e0

  • SHA1

    cf56cf4de4820b4bd89c70f8174a7b3e972ab91a

  • SHA256

    215996b99ee60717a892b741501bcde2420f961b3c17dbc67bfc8bc003a61138

  • SHA512

    4f1cb37d4d9179606a99c4fe059aa71fce5ca1fb9e80f005a58dc49470ca1f841dd90a2e53a10affcfb633f83dd39b8982ef4a3d52f62a255d77272fc02979ea

  • SSDEEP

    6144:+0KU5GpM8F/cPshw/pw74VRiTouojB/zJa6EjFtz0s/3:+0KU5qM8NcPsO/pA4pusIFtzN/3

Score
10/10
formbookdn7rdiscoveryratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Targets

    • Target

      order list.com

    • Size

      252KB

    • MD5

      8e07e5bfcdfb06fe00332798af731c1b

    • SHA1

      f937ba7129daff91a011aaa5ce767db5763c359c

    • SHA256

      1f7edeff96ea1955ea6642e4d739f6a98cb1315d9f78fe23ae3419fb24878103

    • SHA512

      c2ec48656985a8190f10305fc8d11162453457322fceb11c95cd87e0a18099697e3d815db42e0f82166edcf02170c2bf85b4c034d1daeeb285a8466ddaef9318

    • SSDEEP

      6144:wBlL/cdXKcGiepdi1NxLY4kMa/ETi3d09+cy5x7Yq:CedzkEr0x/ETYsjyX8q

    Score
    10/10
    formbookdn7rdiscoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook family

      formbook

    • Formbook payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/bpibxkjlns.dll

    • Size

      31KB

    • MD5

      baf456a0f50b4a00dd3a624bb46b5950

    • SHA1

      1d896ed35f724cd6e5168ebc7e5e670f85eb36f9

    • SHA256

      de5e7a9b204e8cdeaf9c002a81732d8487c4547c0c98d353cab896f92b8c851d

    • SHA512

      e883bfaed10a560ac83b8466e524032148873b3c70411da25124db486863413749cec9e5b80cf593a2f81bca23b139172d8c8e49eb0a2b744b497c5f3a3b13ae

    • SSDEEP

      768:BODooxdJWQvv5RaMcJEJ8f88dHamWlYQodqFuO0oRy:BOFJWK5fIaZlYbil0Cy

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks