formbook

General

Target

JaffaCakes118_94ddeb299ca04b590ae0c67238d000d5212dc6302d97d00a79fbcbb1aa8ba4ae
Size

276KB
Sample

241224-rkq48azkbp
MD5

917c876e0a7bd114e397f1c9dd75c946
SHA1

32bf193be0196d02e3ea7144ca5f7df9a20fa4f4
SHA256

94ddeb299ca04b590ae0c67238d000d5212dc6302d97d00a79fbcbb1aa8ba4ae
SHA512

fb09909ac701a2f76e71ef7c31598ba3238e124f98581c83ba57ac48956b2d73d8e21e732b0ac7a429aec3b57afeb9077ffc8a05c10fc5a591de31467cefaada
SSDEEP

6144:PBKUlr9i3HyuWTjr0OkyHQte38EdF2FHfKIwfBzlUgjxz1YWucND1iwdnh62aE8F:cUlr9i3HR4xkyHQnEdF2FSI4BPUONpiT

Score

10^/10

Malware Config

Extracted

Family

formbook

Campaign

oc5e

Decoy

ODVenWNCx27xmAQc

4XFONwe0gAX06UZqkA==

AD3Pph7KlPo7lQ==

UR3vF7OcYyyilfE=

dYHbq1q35dWIhecnJZ3aFJEGlDwKDoVM

ZjGUfBForJkYdek=

eHXQr1tI+ySegwM4iBtUkk4KNg0FYMk=

4a8FTkEp+vCjm+4=

aCWI49e/KcsQ8E+EU4GeShabmBah

E6V1p68mgTWfSkhOiA==

iWj9y0Sg3MU2lw==

oHsJ45Ot5v14oRA8Ut6Tqxw=

trdTtZNlNF+VuwQU

tEUYVnll1L4ojA==

Es81jGdN1YW3luwCr3T+WFk0wA==

g5eqC/tlYmtjxxJjnZM4

lFju1HzZ7iWVxxEe

4KE7NhR0YoW9Wllpmw==

qWVEpocCITjplgcphg==

FuCHb/9aumc7

Targets

- Target
  
  VNXCNVCVCXJKGSD.exe
- Size
  
  289KB
- MD5
  
  903d0bd798ca8a3387247fb7c17c86d3
- SHA1
  
  bb423a6d299a6b706c63dcf0d793bfdc34ff4bda
- SHA256
  
  aa5a2cc65f212e1ca681e2cdc53fa73dabca4b15ad8319cf07cfae6b513dc6ef
- SHA512
  
  71c260fa5e7267b3f719689f4295a025941401896f01057e692820b46fe682e7ee5861d183aa96e16d67c91d4fc9f79e01af4fcab56ca09ee00a8343b2dec6e6
- SSDEEP
  
  6144:K5BzJCUXtLVxYv1vUF/LGhOzVGboBQvJwrJj/VpTQj2HZ:0rtrBF/bzV1QBSJj/Uj25
Score

10^/10

formbook oc5e discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2