Overview

overview

10

Static

static

3

bb53429c93...18.exe

windows7-x64

10

bb53429c93...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bb53429c934474eb4ae15362b0b0fed9_JaffaCakes118

  • Size

    745KB

  • Sample

    240618-lyds6asenp

  • MD5

    bb53429c934474eb4ae15362b0b0fed9

  • SHA1

    88339aea119d80c639e1e98483936a8ca92e7fce

  • SHA256

    0497ec7bb66f401d56abc2f7d3aec12a4ca977d9ef122513a0781119a949b248

  • SHA512

    5b24c177f0e252547475258d5caa5dfbf58d16d3de48224d00bca0b3edee9b5d505d33c24c58a0a86dc5832425b26431f9145967ca9ddf53a116cf7a9915cffa

  • SSDEEP

    12288:uPq7y8gnl7DlLgY+/HY0nwNtA8utQyoHGaoe6Xk0eXhMMWTIMjdW3rYgbFT/c:cqO7LgYsVw3DlyGiQOVIM5W3kg5T/

Score
10/10
formbookhx251persistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

hx251

Decoy

cttexpresso707870.site

get-motivation.com

0473.ink

tooniker.com

mediacionelite.com

barterdeck.com

revergereview.com

dafaok66.com

nukonu51.win

hotelesnemocon.com

edijsbogomolovs.com

businesoint.com

bsxdq.com

emanuelhospice.com

marlyprojects.com

jsmw297.com

alexandra-wehner.com

detroitpropertymanagment.com

xhtd293.com

uuluav19.com

Targets

    • Target

      bb53429c934474eb4ae15362b0b0fed9_JaffaCakes118

    • Size

      745KB

    • MD5

      bb53429c934474eb4ae15362b0b0fed9

    • SHA1

      88339aea119d80c639e1e98483936a8ca92e7fce

    • SHA256

      0497ec7bb66f401d56abc2f7d3aec12a4ca977d9ef122513a0781119a949b248

    • SHA512

      5b24c177f0e252547475258d5caa5dfbf58d16d3de48224d00bca0b3edee9b5d505d33c24c58a0a86dc5832425b26431f9145967ca9ddf53a116cf7a9915cffa

    • SSDEEP

      12288:uPq7y8gnl7DlLgY+/HY0nwNtA8utQyoHGaoe6Xk0eXhMMWTIMjdW3rYgbFT/c:cqO7LgYsVw3DlyGiQOVIM5W3kg5T/

    Score
    10/10
    formbookhx251persistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks