formbook | 306e993c6513e8c531aab15a44ec6c29f14173e7149d22196470bfe2827130a0

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Spy.Win32.Noon.jgc.53f7f131098f8e57f906ed301cda07e5
Size 496KB
Sample261006-vp3wcssvct
SHA256 306e993c6513e8c531aab15a44ec6c29f14173e7149d22196470bfe2827130a0
MD5 53f7f131098f8e57f906ed301cda07e5
SHA1 f7e65b5ca99606d66d46c8073a95ad8064ba39f9
SHA512 00e7c0654a8170d00ec791e2511216f0f440ea94bb3f4db1f0e3c795561dafa7bb05dabbcd3b2f395d277315aae14f81478691b73c1d5f79778f9d3cfc1d4399
SSDEEP 12288:2+oGh05GcRHVGsZ5cTGhFYJx7y+x6+5Fc:2+eGcNVMTGhFYJh
TLSH
T176B4F168085AC391ECB547360837F36505BEFC62FEE8A20D4612FA417B72ED1F62C166
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

Campaign

he15

Decoy

sarahesurface.com
damoshen2.com
marissabade.com
iwantyoudead.com
caipd.com
donkebabski.com
immpremios.com
detroitindustrialdesign.com
chartsound.com
biocasamance.info
veronikatex.com
myrcellamenshealth.com
thecubiclerebel.com
fod-event.com
jgvmsasaram.com
plainadorable.com
prosportstour.com
wild-earth.life
sofieillusstrations.com
villatatil.net
card-br.com
qqqav81811.com
magnummanhole.net
kimmieslavik.com
hudsonjepertinger.com
shells.design
lesbeautesdeshynee.com
lbvdl.com
cycodeco.com
orlandoconcretepros.net
santaraindonesia.net
0pe447.com
bedsforheads.com
memoryplusfactor.com
ilsongfnb.com
diet-a-studio.com
silverlakeguesthouse.biz
actorchristopherdurbin.com
szfyjs.com
timothysuckow.com
flybabyfootwear.com
wpclasstest.info
saudidesignidea.com
charlesejohnson.info
termitecontrolbutler.com
solidus-crypto.com
tfoxgn.men
todousado.net
ahambrahmasmisatsang.com
kotoj.com
grantssearch.com
xgiballistics.com
doujiangjiyi.net
mokhtarzade.net
teresacarvalhophoto.com
keddiiscoop.com
msyy168.com
data-refinement.info
nodirectionrocks.com
joe-stein.com
wwwnvsay.com
szqnyb.com
westbarnco.com
phenylshouse.com
kolemrine.com

Targets

- Target
  jaffacakes118_Trojan-Spy.Win32.Noon.jgc.53f7f131098f8e57f906ed301cda07e5
- Size 496KB
- SHA256 306e993c6513e8c531aab15a44ec6c29f14173e7149d22196470bfe2827130a0
- MD5 53f7f131098f8e57f906ed301cda07e5
- SHA1 f7e65b5ca99606d66d46c8073a95ad8064ba39f9
- SHA512 00e7c0654a8170d00ec791e2511216f0f440ea94bb3f4db1f0e3c795561dafa7bb05dabbcd3b2f395d277315aae14f81478691b73c1d5f79778f9d3cfc1d4399
- SSDEEP 12288:2+oGh05GcRHVGsZ5cTGhFYJx7y+x6+5Fc:2+eGcNVMTGhFYJh
- TLSH
  T176B4F168085AC391ECB547360837F36505BEFC62FEE8A20D4612FA417B72ED1F62C166
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

he15 discovery formbook rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Formbook

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2