formbook | c0c47a6899f619cf73edc8af9ddc97a620fe2a4f6573a1bd88d35277a2f54ad5

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Spy.Win32.Noon.nnm.94f21152553b807dee1fdb96a5f947bd
Size 692KB
Sample261012-lr35gabc49
SHA256 c0c47a6899f619cf73edc8af9ddc97a620fe2a4f6573a1bd88d35277a2f54ad5
MD5 94f21152553b807dee1fdb96a5f947bd
SHA1 ae38286579de4e9953db5ad0317ca6fabbfddc8f
SHA512 cdf4bbcc17e15a40de048b56555e3a53e86aa0f4692bdc7130d433236332d1b9e7489de45163ac05d7563aab93ce3787b6aad4f9cfc68f65afc3853cadbf39fd
SSDEEP 6144:Q+y82fcL5ry0J44zx07ZTiKhvLwwk+IzqvbVR1T4Od9O:QV82fsy0875fpvJRKa
TLSH
T12BE41B9B33B4392ED6C66B7558B86CF43DC5BC00B77B6B42C97568AF81E2321474C21A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

formbook guloader ph discovery downloader rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

Decoy

arjonacollection.net
autosvilarasau.seat
abetterupdating.online
srilankatravelcompany.com
hvcfa.info
carifilnews-events.com
zer0daylab.com
mirrorxr.com
nextdealworld.com
josiediscounts.com
321tao.com
bjcnganjixk4.com
retain.ltd
lindasavon.com
nhra-go.com
beautifide.info
pelatihanukm.com
verim.site
sytxhl.com
tombrady.agency
skywardenterprises.net
africa.soccer
ergonhome.com
italianmarketatlepores.com
assuranceonscene.com
thisforthatquidproquo.com
ichverkaufemeinauto.com
pristinehealthservice.com
phutung-isuzu.com
maydiamondbeautyandstyle.com
minechemart.net
alekon.info
mixincha.net
dlchenghexin.com
theyogabroad.company
jmxoo.com
cofounder.fund
harveyworldtravellers.com
aeropilatesfuerteventura.com
phonesecuritycamera.com
querdigital.com
deze.ltd
vintagecarpartschoices.com
nuuee.com
walktofinancialfreedom.com
acilklimaservisi.net
getonbonfire.net
oldthaitv.com
spjmt.com
e-animalworks.net
bgnovosti.com
mediquipmedicalsolutions.net
logikadanteknik.site
newbalanceoutletsale.com
carriagehiresouthwest.com
wwwk3355e.com
bibajaravevev.com
freamsg.online
legalgrowthadvisor.com
mariacatalinalochocki.com
globalapollo.com
skywx.net
xn--eckho4iydwa8i.site
rastlosproduksjon.com
epsycoachez.com

Targets

- Target
  jaffacakes118_Trojan-Spy.Win32.Noon.nnm.94f21152553b807dee1fdb96a5f947bd
- Size 692KB
- SHA256 c0c47a6899f619cf73edc8af9ddc97a620fe2a4f6573a1bd88d35277a2f54ad5
- MD5 94f21152553b807dee1fdb96a5f947bd
- SHA1 ae38286579de4e9953db5ad0317ca6fabbfddc8f
- SHA512 cdf4bbcc17e15a40de048b56555e3a53e86aa0f4692bdc7130d433236332d1b9e7489de45163ac05d7563aab93ce3787b6aad4f9cfc68f65afc3853cadbf39fd
- SSDEEP 6144:Q+y82fcL5ry0J44zx07ZTiKhvLwwk+IzqvbVR1T4Od9O:QV82fsy0875fpvJRKa
- TLSH
  T12BE41B9B33B4392ED6C66B7558B86CF43DC5BC00B77B6B42C97568AF81E2321474C21A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

ph discovery formbook rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Formbook

Formbook payload

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2