Overview

overview

10

Static

static

3

order list.exe

windows7-x64

10

order list.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    JaffaCakes118_4e94655c7c0870f82b0c339638abc3e0
  • Size 329KB
  • Sample250101-knbqdaspgn
  • SHA256 215996b99ee60717a892b741501bcde2420f961b3c17dbc67bfc8bc003a61138
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
formbookdn7rdiscoveryratspywarestealertrojan

Malware Config

Extracted

Family

  • formbook

Version

  • 4.1

Campaign

  • dn7r

Decoy

  • eventphotographerdfw.com

  • thehalalcoinstaking.com

  • philipfaziofineart.com

  • intercoh.com

  • gaiaseyephotography.com

  • chatbotforrealestate.com

  • lovelancemg.com

  • marlieskasberger.com

  • elcongoenespanol.info

  • lepirecredit.com

  • distribution-concept.com

  • e99game.com

  • exit11festival.com

  • twodollartoothbrushclub.com

  • cocktailsandlawn.com

  • performimprove.network

  • 24horas-telefono-11840.com

  • cosmossify.com

  • kellenleote.com

  • perovskite.energy

Targets

    • Target
      order list.com
    • Size 252KB
    • SHA256 1f7edeff96ea1955ea6642e4d739f6a98cb1315d9f78fe23ae3419fb24878103
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    formbookdn7rdiscoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook family

      formbook

    • Formbook payload

      rat

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/bpibxkjlns.dll
    • Size 31KB
    • SHA256 de5e7a9b204e8cdeaf9c002a81732d8487c4547c0c98d353cab896f92b8c851d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks