formbook

General

Target

JaffaCakes118_5ede73c34f56df7353c2516b0b544d3d
Size

530KB
Sample

250107-m1vecsznan
MD5

5ede73c34f56df7353c2516b0b544d3d
SHA1

3245d570c89fb1e5e4ff7f216aa6cb12099726e2
SHA256

bb6c08035fd7dc06d3ace7952af7bd640c45c548e087dba1deaa45f1861b0077
SHA512

5adf0752e70c5a04eabf3a5eb8d0694836e510421cf87057410bb95e4085fb6cb775793b27fc97a32ba7ff06276bfacd23e7090c42a62b45cef220e005f0d07e
SSDEEP

6144:x6Uqd2GhNNLrM+qqpEu+VNlJ5xIjXDGwtwy/hkHa7wZjEHG85v0zLTgk46CKmqId:IUi2iN53E15iDGwtwohw5V8x0+FD6e

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s2wt

Decoy

yukiyamaapperal.com

rumasultan.store

japaese.com

quangphatloi.com

148atk.xyz

myheatstore.online

theedeneconomy.com

5xssc1.icu

krakensistem.xyz

gwangyo.com

lj-safe-keepingkokoka6.xyz

naturetheaterofoklahoma.com

perayaanwisudaitb.com

hrbsxxf.com

allencountypallet.com

vizit-app.com

startstartnow.com

inviertechile.com

haysneedlepotracks.com

cfdbestbroker.online

Targets

- Target
  
  JaffaCakes118_5ede73c34f56df7353c2516b0b544d3d
- Size
  
  530KB
- MD5
  
  5ede73c34f56df7353c2516b0b544d3d
- SHA1
  
  3245d570c89fb1e5e4ff7f216aa6cb12099726e2
- SHA256
  
  bb6c08035fd7dc06d3ace7952af7bd640c45c548e087dba1deaa45f1861b0077
- SHA512
  
  5adf0752e70c5a04eabf3a5eb8d0694836e510421cf87057410bb95e4085fb6cb775793b27fc97a32ba7ff06276bfacd23e7090c42a62b45cef220e005f0d07e
- SSDEEP
  
  6144:x6Uqd2GhNNLrM+qqpEu+VNlJ5xIjXDGwtwy/hkHa7wZjEHG85v0zLTgk46CKmqId:IUi2iN53E15iDGwtwohw5V8x0+FD6e
Score

10^/10

formbook s2wt discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2