formbook

General

Target

JaffaCakes118_664920ea617d6c5f15c228b7374aa15f
Size

482KB
Sample

250107-q18hrsvrck
MD5

664920ea617d6c5f15c228b7374aa15f
SHA1

3cdf04f5f2d732f0a199151ff35af27a4cce12aa
SHA256

65acd8c73c518c97a1539bc8e3f62fb8f06431d7030c6cc1463c855aec0ec46f
SHA512

ba40b25f6f45b32001929a7da37b512a8d642e0b45ca19ff0dc2edadf82982b84f8b9a51c9781c30226ec6c05cb12bb50ef252f227cf8d790d390a26400c5462
SSDEEP

6144:mhdtBhm+BNEW6Uqd2GhNwv/uCaIhInekTtAnVk3RfMofArTufGjK0V:4dPhuzUi2iNwnu6InekGnVk3jIT

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s18y

Decoy

jokes-online.com

dzzdjn.com

lizzieerhardtebnaryepptts.com

interfacehand.xyz

sale-m.site

block-facebook.com

dicasdamadrinha.com

maythewind.com

hasari.net

omnists.com

thevalley-eg.com

rdfj.xyz

szhfcy.com

alkalineage.club

fdf.xyz

absorplus.com

poldolongo.com

badassshirts.club

ferienwohnungenmv.com

bilboondokoak.com

Targets

- Target
  
  JaffaCakes118_664920ea617d6c5f15c228b7374aa15f
- Size
  
  482KB
- MD5
  
  664920ea617d6c5f15c228b7374aa15f
- SHA1
  
  3cdf04f5f2d732f0a199151ff35af27a4cce12aa
- SHA256
  
  65acd8c73c518c97a1539bc8e3f62fb8f06431d7030c6cc1463c855aec0ec46f
- SHA512
  
  ba40b25f6f45b32001929a7da37b512a8d642e0b45ca19ff0dc2edadf82982b84f8b9a51c9781c30226ec6c05cb12bb50ef252f227cf8d790d390a26400c5462
- SSDEEP
  
  6144:mhdtBhm+BNEW6Uqd2GhNwv/uCaIhInekTtAnVk3RfMofArTufGjK0V:4dPhuzUi2iNwnu6InekGnVk3jIT
Score

10^/10

formbook s18y discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2