formbook

General

Target

315d94cd58a1c7dff9a4d8d5b1738ea0_JaffaCakes118
Size

259KB
Sample

240330-cy78bsfh79
MD5

315d94cd58a1c7dff9a4d8d5b1738ea0
SHA1

62897af36ee9aaa7c2bfe5cf95f4f32980c40d4d
SHA256

f5147e31e0b9d16e5307686247d22799809000bd55527170d8e5f72f030ab455
SHA512

cb97e7e8a8b84cdba5167825b3b727a5b5df7aaa7b04b986b0b83256ac6e0782bed488aa35fb1f3ced49e2392d755cd36527aa20b377012f1637de18f18a7a11
SSDEEP

6144:F8LxBsIqbBd4HGbfScpB1cR2dlGk27XjQRjaO/ouOeo:/vLb/cg8jQRmOZOeo

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s3dy

Decoy

ravlygte.info

marketnewsville.online

flooring-envy.com

flavourhouston.com

donghohanghieunam.com

globleitsolutions.com

digitalgraphicarts.com

cupidbeautybar.com

cannavybes.com

negative-dsp.com

littledali.com

meltwatersoftware.info

blackdogland.com

danasales.com

mississippiscorecard.com

mainesmoker.com

sirenxinlilzixun.com

tychehang.com

gentciu.com

weckloltd.com

Targets

- Target
  
  315d94cd58a1c7dff9a4d8d5b1738ea0_JaffaCakes118
- Size
  
  259KB
- MD5
  
  315d94cd58a1c7dff9a4d8d5b1738ea0
- SHA1
  
  62897af36ee9aaa7c2bfe5cf95f4f32980c40d4d
- SHA256
  
  f5147e31e0b9d16e5307686247d22799809000bd55527170d8e5f72f030ab455
- SHA512
  
  cb97e7e8a8b84cdba5167825b3b727a5b5df7aaa7b04b986b0b83256ac6e0782bed488aa35fb1f3ced49e2392d755cd36527aa20b377012f1637de18f18a7a11
- SSDEEP
  
  6144:F8LxBsIqbBd4HGbfScpB1cR2dlGk27XjQRjaO/ouOeo:/vLb/cg8jQRmOZOeo
Score

10^/10

formbook s3dy rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/jlxoobekmde.dll
- Size
  
  27KB
- MD5
  
  189d691c4e7ce2f29b9d58adad188433
- SHA1
  
  789dd91184f4f0ac527864affeda48b6073044c2
- SHA256
  
  12133ef575799710fd71f97d200f449ba861020afe56688ca2886f3a45896109
- SHA512
  
  51ec6048922b8d069af3d48eca7858b9a3654b094f62edea3f8115aa086354de123f0eaf0d4ca20cadf11f2342dae8c44580976765bf33a3508d1a74f9f234ae
- SSDEEP
  
  768:WoFuDrc9RGl9Y8FbDkAkXa371XzFaqZXfI0ipfMI:xErUGlBr0a9zvv2pfD
Score

10^/10

formbook s3dy rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral3 behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Loads dropped DLL

Suspicious use of SetThreadContext

Formbook

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4