formbook

General

Target

JaffaCakes118_9adf3bc548af5606c220c94710d00ba0527bb963669d25bd3a19fba7e161b852
Size

674KB
Sample

241230-g74cys1jgm
MD5

b6d895a8f3f9bac6d6c388a83ecb3263
SHA1

f739cafc7e9a5883669f92b279e5ead0f9a9dec4
SHA256

9adf3bc548af5606c220c94710d00ba0527bb963669d25bd3a19fba7e161b852
SHA512

5a0374092ba65d1e7d121c0f82173faf3a2be0c0ec1ba609ae08560e3e0651d9b152dabfa338e1e65106b9843ccf6d8c9a594fc455ce560e0c245a98a0be01cd
SSDEEP

12288:Zvl0E71FB8OdUWv8Nmc6+XdOuqqE+Cd72eGmZg5//RqSxBS8L2jUUBI6Flz:ZGE18Oa8uO4NiieGmZgxRM8LGF9

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

o5df

Decoy

glassesfx.com

yunboer.com

countryvillagerx.com

ravensclawcollectibles.net

ambiencebodytherapies.com

cbcgroup.solutions

east2westcoasters.xyz

vegasggcuan.com

sistempakarsapi.site

assoroc-chinon.com

thegauntletchallenge.com

johnandsophie.com

followeona.xyz

bulgurmachines.online

pippaandi.com

warax.online

trygamesandearnrewards.com

newssergipe.com

savingsellersthousands.com

sniibe.com

Targets

- Target
  
  isco order.com
- Size
  
  991KB
- MD5
  
  cac11d14a8b8c288538e976d0161c6f5
- SHA1
  
  d896a8d1ed1cbad3fea136f72e070aaeef18251b
- SHA256
  
  3164f706acbe68f271528451bc6a469956d490a839d00a1194438d9e3c187c37
- SHA512
  
  187cb3038406056245042f3b1983f8a0df00af1b53fef53c9ea02e9130d2aff355bfcbfa4b58bd81734cd166282af5fdad406aca00a0519f05fd66776c31c0c5
- SSDEEP
  
  12288:Nm/TqQ1NEE2wxDawdH3k2oI6aX1lEJz9QOyBEzSRMeQxANAc:oLqQ1rlVZ6e5OpzSKe6W
Score

10^/10

formbook o5df discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Deletes itself

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2