formbook

General

Target

3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118
Size

253KB
Sample

240330-mldhasea53
MD5

3a5c5bb43232e4e48b63cdf123dec876
SHA1

95b478c57de28b87d6bd87dd32a4faec02b0d620
SHA256

e5ebc473e259ec57e2a831477b449dd07c13198c0db74ce67732a8fce59e25ac
SHA512

59bd907d7faa8aab41c1cfc78d0aabf8592e8e1e8b49abc4340b807718b96d2e281270f15a5767d6df4e4acde5375ed20756c8598019ed927866dc25c70f7281
SSDEEP

3072:wBynOpL12riocLMjve4LOk2AcxISCGn2rc2gGw7cMC9oyZ9rUoyBz92bO511D0tv:wBlL/c/LOk2Ac3CGn2cb1n5LD0t2lDy

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rv9n

Decoy

olivia-grace.show

zhuwww.com

keiretsu.xyz

olidnh.space

searuleansec.com

2fastrepair.com

brooklynmetalroof.com

scodol.com

novaprint.pro

the-loaner.com

nextroundscap.com

zbwlggs.com

internetautodealer.com

xn--tornrealestate-ekb.com

yunjiuhuo.com

skandinaviskakryptobanken.com

coxivarag.rest

ophthalmologylab.com

zzzzgjcdbqnn98.net

doeful.com

Targets

- Target
  
  3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118
- Size
  
  253KB
- MD5
  
  3a5c5bb43232e4e48b63cdf123dec876
- SHA1
  
  95b478c57de28b87d6bd87dd32a4faec02b0d620
- SHA256
  
  e5ebc473e259ec57e2a831477b449dd07c13198c0db74ce67732a8fce59e25ac
- SHA512
  
  59bd907d7faa8aab41c1cfc78d0aabf8592e8e1e8b49abc4340b807718b96d2e281270f15a5767d6df4e4acde5375ed20756c8598019ed927866dc25c70f7281
- SSDEEP
  
  3072:wBynOpL12riocLMjve4LOk2AcxISCGn2rc2gGw7cMC9oyZ9rUoyBz92bO511D0tv:wBlL/c/LOk2Ac3CGn2cb1n5LD0t2lDy
Score

10^/10

formbook rv9n rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/ylbzgkuxqsi.dll
- Size
  
  31KB
- MD5
  
  51d6f1227b9a2e0b090c9d0dab9d4528
- SHA1
  
  43149a31386cd9613c5b0e8a218f1e7cc7f77af8
- SHA256
  
  23e80d01cf007b17f91366fb1866568f0385ff08767434728f209535d3452fdd
- SHA512
  
  b85fd793d0ddf2e96833b458fee64008ff13a863a4b9ba044bf916efc41947fdadc13cfb1deaa151d58c162d706e32226e14ea2a7ba82557eccff329c9e38afb
- SSDEEP
  
  768:ovoaaC/7aXedJGhoDJLpKQmZuu82bkBYQo/LukLt3KWA:ovoaaC/76eHGhippKQmZuu1wBYBLRJKX
Score

3^/10
behavioral3 behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4