formbook | 3f361cbbe317da82af1fd1f3591b47d347c4029afb4f0370e301f862ca1e8c0a

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.a5363b0fc06d420b145527a53a06be79
Size 548KB
Sample261009-vfpmda1tfx
SHA256 3f361cbbe317da82af1fd1f3591b47d347c4029afb4f0370e301f862ca1e8c0a
MD5 a5363b0fc06d420b145527a53a06be79
SHA1 b4179096c7d42bc9dc0cdffbad656158eabcd0e8
SHA512 3701be732c0d99bef3e005ab676b613a8f55192216ce311a8c0b2aab37f2ca9171ab2b07661939736e2cc7eab715e27675150f2b538f76212bd0d9d97e62a72c
SSDEEP 12288:DQGo0UzUzUzUq4949494J+0/+0/+0/+0/+0/FYNmYNmYNmYNmYNmP8yl8yl8yl8/:MGo0UzUzUzUq4949494J+0/+0/+0/+0s
TLSH
T1A1C44766BA46CA61C56905313C59E8EC2532BC48CF58C85733EBBF8FE6BF681C84D194
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

aa8

Decoy

gowydn47qz2ki1mat.cricket
fullvinresearch.com
bralinmoca.com
m9software.com
ride4life.fund
balolab.com
warheroeshack.com
qzjxcc.com
loziitee.com
fabinmetal.com
jpexecutivecoach.com
sarkariphone.com
movetofind.com
fhy.info
plexcoins.tech
wherewillshego.com
aprendeabloggear.com
tonelovers.com
tuixachdeocheo.com
myvape.store
sportsfishingtechgames.com
lubromation2.com
xn--fiqr9gttsmik.com
ambassadormassagebristol.com
asirvia.store
hsky.ltd
topneck.com
moonlitejewelers.com
wallstreet.team
a11.systems
toupiaopk.com
t87k38.info
arkansawheritage.com
taj-city.com
zaatiti.com
kiaaster.com
bfmfiting.com
renewneuro.com
gqrenmoxddnkjkfdbwkke.com
takeactionnow.win
nadangka.com
depuis1947.com
crowdifer.com
arianeemax.com
cowboyboots.ltd
zgq9.com
theultimatechristmaspresent.com
thehamptoncafe.com
celebism.com
sedatozyurt.com
kevinhappy.win
cryptobrokeronline.com
vsbias-corp.com
hardening.store
uxdupq.site
ledong1111.com
fbohl.net
pboxp.info
apachehvac.com
bldrlifestyle.com
miamibusinesslitigation.info
vitelstars-saldi.site
aug-games.com
5pvgfvwyd1.biz
nadidetadllar.com

Targets

- Target
  jaffacakes118_HEUR.Trojan.Win32.Generic.a5363b0fc06d420b145527a53a06be79
- Size 548KB
- SHA256 3f361cbbe317da82af1fd1f3591b47d347c4029afb4f0370e301f862ca1e8c0a
- MD5 a5363b0fc06d420b145527a53a06be79
- SHA1 b4179096c7d42bc9dc0cdffbad656158eabcd0e8
- SHA512 3701be732c0d99bef3e005ab676b613a8f55192216ce311a8c0b2aab37f2ca9171ab2b07661939736e2cc7eab715e27675150f2b538f76212bd0d9d97e62a72c
- SSDEEP 12288:DQGo0UzUzUzUq4949494J+0/+0/+0/+0/+0/FYNmYNmYNmYNmYNmP8yl8yl8yl8/:MGo0UzUzUzUq4949494J+0/+0/+0/+0s
- TLSH
  T1A1C44766BA46CA61C56905313C59E8EC2532BC48CF58C85733EBBF8FE6BF681C84D194
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

aa8 discovery formbook rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Formbook

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2