formbook | 99dd8e07152deb6c8f9d5f4e011d17b9ccfb7c7e57905eeaf6b9143be04a3a69

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Spy.Win32.Noon.akjy.5d39a46e446bc955508d661d5ddb4585
Size 676KB
Sample261008-vnn1tabt9y
SHA256 99dd8e07152deb6c8f9d5f4e011d17b9ccfb7c7e57905eeaf6b9143be04a3a69
MD5 5d39a46e446bc955508d661d5ddb4585
SHA1 0a4c75598cce6dd2d69b59d1300e0382d26ebdae
SHA512 d3803911e15708002d494e579bfb5ec1531778140e65466ef14b15633c212114779e6c1826adabe51ce41eaf275cc823ce344ecbbcc75bb4f7748f4eaed87f30
SSDEEP 12288:r+80+3EU28PzDJF9dBrVSxXsYoiDREmGG0Q9Wt:r+j2EUfPJF9dhVBYJ61GV2
TLSH
T1B6E47D6033F7A95CE4BB9FB5AD7A44C8D9BB7D190F1A592E152041CA1C39FC09C24E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

formbook fr discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

Decoy

ttluav87.com
nnamswo.online
namatco.com
xn--vcklm8gd8hl2e.biz
shimada-ryota-hair.com
whimsicalwar.com
centrosabervivir.com
badassfloor.com
magnolia-flower.com
cinthiatorres.com
img2systemtotalsend.com
sochiccakesatl.com
windowtintingsyracuse.com
xn--fiq624d8nf7uqjzm.com
namoni.com
dermnaturale.com
mor.company
twinklepony.com
makeup.institute
bashirgoods.com
hutter.guru
beeptide.com
tasteofeastaustin.com
dussokagi.com
shutterandeye.com
pornoray.net
restaurantmillionaire.store
roguemillennal.com
millionaireblogging.com
michaelstestkitchen.com
feetandfanny.com
emily-jewelry.com
bjcnganjixk18.com
greyhoundconnections.com
christineadamec.net
dwhitcontracting.com
siokolee.com
web-flash-vorlagen.com
vtworldwide.com
reserve-epicurien.com
nu8drjkispp.biz
info-consutling.com
bugatti.cloud
circlelevents.com
calcuime.com
bestmoviepremium.com
elbaulturquesa.com
hybridpic.com
jewelrays.com
colorcodedconfetti.com
ddluav58.com
jeddahresources.com
redsonlinestore.com
mdcer.com
itworxfitgym.com
ivokuzov.com
czdesign.ltd
diyrat.com
akizuki-mokko.com
keyboardmen.com
zhonghezq.com
kapadokyaguvec.com
recoverycommunitycenterdet.info
lifestyleet.com
kovaxy.com

Targets

- Target
  jaffacakes118_Trojan-Spy.Win32.Noon.akjy.5d39a46e446bc955508d661d5ddb4585
- Size 676KB
- SHA256 99dd8e07152deb6c8f9d5f4e011d17b9ccfb7c7e57905eeaf6b9143be04a3a69
- MD5 5d39a46e446bc955508d661d5ddb4585
- SHA1 0a4c75598cce6dd2d69b59d1300e0382d26ebdae
- SHA512 d3803911e15708002d494e579bfb5ec1531778140e65466ef14b15633c212114779e6c1826adabe51ce41eaf275cc823ce344ecbbcc75bb4f7748f4eaed87f30
- SSDEEP 12288:r+80+3EU28PzDJF9dBrVSxXsYoiDREmGG0Q9Wt:r+j2EUfPJF9dhVBYJ61GV2
- TLSH
  T1B6E47D6033F7A95CE4BB9FB5AD7A44C8D9BB7D190F1A592E152041CA1C39FC09C24E3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

fr discovery formbook rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Formbook

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2