formbook

General

Target

98b7b0e6a8b0364de5fe1ba86b7c6bfd_JaffaCakes118
Size

363KB
Sample

241125-c56m3stpgv
MD5

98b7b0e6a8b0364de5fe1ba86b7c6bfd
SHA1

762bb698218c43e1aa722cb518e542184d439093
SHA256

c74a1ee1bb642221d811a5c617c175c09bca2cf5d6937f7981b9825eab5ef127
SHA512

e21731fb5edda7567fb3acbf4ed43176e768c309cde67b48b9c13942f77d3c91b635463c795d6fca00f8589436bf9bc1287e2ffa8a4176805a05a6ae5776b878
SSDEEP

6144:fKCmflvhYuh+7ddSZkaNGRkVpidh1XlL8BW48UWSFltIkb3IpWiAjT:fKCmNvhYuh+7+ZIRkV2tlyWaWSHp3I8b

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dd2v

Decoy

jkrqzmeyd.icu

cbluedottvwdshop.com

yhchen.space

premierhealthnwellness.com

szkuyaju.com

harvestmoonloans.net

dadematerial.com

mariaclarahairstudio.com

hwunvy.online

puloutjbmere.com

kossu1989.com

dubbedos.com

ncylis.com

hybrid-sol.com

travelature.com

gracefulcounts.com

66secretgarden.com

eslonyourcell.com

wisersponsorship.com

sepn3.com

Targets

- Target
  
  98b7b0e6a8b0364de5fe1ba86b7c6bfd_JaffaCakes118
- Size
  
  363KB
- MD5
  
  98b7b0e6a8b0364de5fe1ba86b7c6bfd
- SHA1
  
  762bb698218c43e1aa722cb518e542184d439093
- SHA256
  
  c74a1ee1bb642221d811a5c617c175c09bca2cf5d6937f7981b9825eab5ef127
- SHA512
  
  e21731fb5edda7567fb3acbf4ed43176e768c309cde67b48b9c13942f77d3c91b635463c795d6fca00f8589436bf9bc1287e2ffa8a4176805a05a6ae5776b878
- SSDEEP
  
  6144:fKCmflvhYuh+7ddSZkaNGRkVpidh1XlL8BW48UWSFltIkb3IpWiAjT:fKCmNvhYuh+7+ZIRkV2tlyWaWSHp3I8b
Score

10^/10

formbook dd2v discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2