formbook

General

Target

JaffaCakes118_1b9347ac7827deee5e937a9463fe3f03d8326740ca9d1661bf09c58905c264a6
Size

910KB
Sample

241221-x1cjnaxkat
MD5

b78da72b0e4575c3e418368d90047ede
SHA1

ebdda1744d5fc972a3694461f2a95e34a0fcbfe4
SHA256

1b9347ac7827deee5e937a9463fe3f03d8326740ca9d1661bf09c58905c264a6
SHA512

0c0a388e923682fac8f06173ae5a7b4c2c40ac05a8ae5833386cf58a86c8596aa5d924731a19990068c60866f0db30a9e43ea03dcbba3a2301affd11e04e412b
SSDEEP

12288:TJnpqt+UJF8Y4yDYiekcykYp/z1yGbhxWRwkzUNEnaZGnQ767INeLc:do4yDYiJcykYdKSN2oGnKNeLc

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

nyk

Decoy

mrlens.net

timeindolls.com

mov.solutions

byonf.com

truenotice.com

thetennesseebarn.com

emiss.online

smallfryspharmacy.com

100percentbikes.com

nanshanbishengke.com

hellohomeowner.com

investorvisa4uk.com

majesticpoodlehomes.com

zaoresorthouse.com

projewelrys.com

adherellc.xyz

usamamembers.com

buygreatsales.com

seniordevops.world

bungalowfollowbestowed.com

Targets

- Target
  
  JaffaCakes118_1b9347ac7827deee5e937a9463fe3f03d8326740ca9d1661bf09c58905c264a6
- Size
  
  910KB
- MD5
  
  b78da72b0e4575c3e418368d90047ede
- SHA1
  
  ebdda1744d5fc972a3694461f2a95e34a0fcbfe4
- SHA256
  
  1b9347ac7827deee5e937a9463fe3f03d8326740ca9d1661bf09c58905c264a6
- SHA512
  
  0c0a388e923682fac8f06173ae5a7b4c2c40ac05a8ae5833386cf58a86c8596aa5d924731a19990068c60866f0db30a9e43ea03dcbba3a2301affd11e04e412b
- SSDEEP
  
  12288:TJnpqt+UJF8Y4yDYiekcykYp/z1yGbhxWRwkzUNEnaZGnQ767INeLc:do4yDYiJcykYdKSN2oGnKNeLc
Score

10^/10

discovery formbook nyk rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- CustAttr .NET packer
  Detects CustAttr .NET packer in memory.
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

CustAttr .NET packer

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2