Overview

overview

10

Static

static

3

1b02b2110a...18.exe

windows7-x64

10

1b02b2110a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1b02b2110a83c75e00319da7df7f1ed3_JaffaCakes118

  • Size

    507KB

  • Sample

    240701-mx2n9sxcqg

  • MD5

    1b02b2110a83c75e00319da7df7f1ed3

  • SHA1

    01ca66b6bd83c1c4e9168767422815b327bfa2a2

  • SHA256

    6a0c21a5a37e307becd9ed9bdee0f3f41e3d1a61847a6e9ae272ec891d4f7728

  • SHA512

    93eee319549c963b9639a1bdf05f872e7834afdbd6fc7167cd40cb579e607e7b212c259cb8aae08190f0c827e0da448903a161f1ae98ee397c38afa8059ac2ce

  • SSDEEP

    12288:pSlQOcPTxF0cvmpJZIxXwWW2WiZnqrw+fuJptW+3e3miUZ:OKTxacvmPZIxjmiFqr/u1LUC

Score
10/10
formbookffwevasionratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ffw

Decoy

unmutedgenerations.com

localmoversuae.com

centralrea.com

geyyfphzoe.com

silverpackfactory.com

techtronixx.com

shop-deinen-deal.com

buehne.cloud

inspirefreedomtoday.com

chapelcouture.com

easton-taiwan.com

quanaonudep.store

merzigomusic.com

wpzoomin.com

service-lkytrsahdfpedf.com

yeasuc.com

mydogtrainingservice.com

galeribisnisonline.com

cscremodeling.com

bom-zzxx.com

Targets

    • Target

      1b02b2110a83c75e00319da7df7f1ed3_JaffaCakes118

    • Size

      507KB

    • MD5

      1b02b2110a83c75e00319da7df7f1ed3

    • SHA1

      01ca66b6bd83c1c4e9168767422815b327bfa2a2

    • SHA256

      6a0c21a5a37e307becd9ed9bdee0f3f41e3d1a61847a6e9ae272ec891d4f7728

    • SHA512

      93eee319549c963b9639a1bdf05f872e7834afdbd6fc7167cd40cb579e607e7b212c259cb8aae08190f0c827e0da448903a161f1ae98ee397c38afa8059ac2ce

    • SSDEEP

      12288:pSlQOcPTxF0cvmpJZIxXwWW2WiZnqrw+fuJptW+3e3miUZ:OKTxacvmPZIxjmiFqr/u1LUC

    Score
    10/10
    formbookffwevasionratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks