formbook

General

Target

JaffaCakes118_fe43b8fee96f78e23b43740ac4bf858ed7c255676dd6f7c1386c0017fc770855
Size

704KB
Sample

241221-23lmkatlap
MD5

e17f3f53f413bd950c7ec620e75564ee
SHA1

cf5a7a72a25d36e243c8f6deef537770536bc3a0
SHA256

fe43b8fee96f78e23b43740ac4bf858ed7c255676dd6f7c1386c0017fc770855
SHA512

a6c80998ed5e73a44a3e0a2ee9e411513613c5095d1a38c86bdccf52f4035baa6e0a5a203c73194de300a2893095f3b22e55be77aa435eb3fb1e15166a462380
SSDEEP

12288:h7+vGhiIgON8Z6O47uddNag6o6fuTjprf/9SVE8iO0oHh02DOs7tlE:psIgON/3u76m99kE8RHVN7U

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

o85a

Decoy

lvmh.store

grantrec.online

pinkglam.net

springreno.com

moneynappress.com

disclegends.net

taizonee9.app

3365826.com

asdmohs19.website

atlantapolicy.com

rioinvestmentrd.com

alltriciashomemadegoodies.com

duanvidentcenter.com

whitelabelcasino.xyz

uptick.business

kickverseblade.store

malmotairi.com

nazhan.site

nehimiah.world

aero-bell.com

Targets

- Target
  
  My order pdf.bin
- Size
  
  973KB
- MD5
  
  80c0e20bcbc0a9a1fe14fd381cbf2d18
- SHA1
  
  e5024ce6f861d605cc36aa732146d10b163c4340
- SHA256
  
  5ce5432b57df502d836094e69081a43011e6d62c3ea019c0943e7c305a17d059
- SHA512
  
  7bc014ac086f7147a831b0c887dae5485b31d4fe1e8341949b4364f8b1df2eedb14c0cf8749b59cd8e8802953f12f292efe2e02e5dc5b34e55d19ad8ae56b2b3
- SSDEEP
  
  12288:AtxaV1ki3Ir3TOAWg9ojA5xnLpdtLSCfC/wYB+aTY3gg+/SzS3O1r5:AtIVui3IrjIg9ojA5xnpkhRTDg+8
Score

10^/10

formbook o85a discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2