formbook | 7d742e98a3347a1425857c7573aa0e465564859b09c24e46c58cc2de7f045999

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Spy.Win32.Noon.jfk.c871442586e92dd206afb65070c7c826
Size 496KB
Sample261006-vpy76ssvby
SHA256 7d742e98a3347a1425857c7573aa0e465564859b09c24e46c58cc2de7f045999
MD5 c871442586e92dd206afb65070c7c826
SHA1 77f3b71d76dfbf65244731cf59ed219c35ad09c3
SHA512 93aa4f78f6b44b0705bf0918f6ae59a819271ab0b5d8e07db49cb736d5f6a9bd54e21d386334f17674e32b0eac1c04d80b86a6ea90000dd8ed852309819f7c6c
SSDEEP 6144:WwAP6SDToxMLaqJnJHY1rLIgmLotQgA3Dr9ylF5TUg2XsRPu5I:W7XoCHVdY1rMgmLotsv94n2X
TLSH
T151B4F1755B39479DC85CE772EA22721F64AD4D616E69B30D0108B6D1FF382EC90F28B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

formbook vi discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

Decoy

417bv.com
vlner.com
tc-onestep.com
rainyhumming.com
siriandpatricia.com
libertepe.com
qeleen.com
artemisdivine.com
herhaven.life
eraloka-arsitek.com
nvcdxvxcnow.online
aluadas.com
feesar.com
newmailstech.com
lutexia-co.com
armenianvegetarian.com
icamstore.com
teamxpedition.com
svcitskype.com
hongdajingchengmenchuang.com
thewinestache.com
svalinshield.com
emiratesmanagementgroup.com
cpfhomeinspections.com
positionvague.site
clickindianfood.com
xn--pss92ib3i5p2a.com
hotels-discount-car-rentals.com
btczs.net
www385456.com
apothicbeautyandbrows.com
schoolsroots.com
thekalpataruyashodhan.net
teacmor.net
shasky.net
purebredpomeraniansales.com
topexclusive.net
xmx024.com
pilgrim-baits.com
cuffmail.com
secure-systemaccess.info
eight31influence.com
coodazz.com
108code.com
domaincheck.tips
educate2improve.com
electrified-racing.net
qqgan48.com
swnbe.info
497bad.info
kngmw9f.info
hairgrowth.life
wnhfjq.info
securepaypal.com
thriftylittleprincess.com
charlesling.com
beardedmanproductions.com
northtexasabode.com
thechiroagency.com
shilongwang.info
442bifa.com
pokemongo-55.com
sssav45451.com
fetchyourfree.download
cumswart.com

Targets

- Target
  jaffacakes118_Trojan-Spy.Win32.Noon.jfk.c871442586e92dd206afb65070c7c826
- Size 496KB
- SHA256 7d742e98a3347a1425857c7573aa0e465564859b09c24e46c58cc2de7f045999
- MD5 c871442586e92dd206afb65070c7c826
- SHA1 77f3b71d76dfbf65244731cf59ed219c35ad09c3
- SHA512 93aa4f78f6b44b0705bf0918f6ae59a819271ab0b5d8e07db49cb736d5f6a9bd54e21d386334f17674e32b0eac1c04d80b86a6ea90000dd8ed852309819f7c6c
- SSDEEP 6144:WwAP6SDToxMLaqJnJHY1rLIgmLotQgA3Dr9ylF5TUg2XsRPu5I:W7XoCHVdY1rMgmLotsv94n2X
- TLSH
  T151B4F1755B39479DC85CE772EA22721F64AD4D616E69B30D0108B6D1FF382EC90F28B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery vi formbook rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Formbook

Formbook payload

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2