formbook | 6934eb93d7b5e16de0687da48a001b95c84f2b741e3e8775c8e32dcb70cf5b13 | Triage

Sharing

General

Target

crypt1.exe
Size

773KB
Sample

200708-gf99lnk8vx
MD5

10bd8c618d9c9336eaee4cbcd815f398
SHA1

4e01cc508c1487539f26053394f158a76b1d1402
SHA256

6934eb93d7b5e16de0687da48a001b95c84f2b741e3e8775c8e32dcb70cf5b13
SHA512

26f21c5fa2975f30cc59cbb66b5ff0c936089fb7d29c331514b82e8e6dd19c010e14c81b12ce4ffd0223b6df3b9a9ae17113f1a2853d9aa60766b5839a6be489

Score

10^/10

formbook evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  crypt1.exe
- Size
  
  773KB
- MD5
  
  10bd8c618d9c9336eaee4cbcd815f398
- SHA1
  
  4e01cc508c1487539f26053394f158a76b1d1402
- SHA256
  
  6934eb93d7b5e16de0687da48a001b95c84f2b741e3e8775c8e32dcb70cf5b13
- SHA512
  
  26f21c5fa2975f30cc59cbb66b5ff0c936089fb7d29c331514b82e8e6dd19c010e14c81b12ce4ffd0223b6df3b9a9ae17113f1a2853d9aa60766b5839a6be489
Score

10^/10

evasion trojan spyware stealer formbook persistence
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run entry to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasiontrojanspywarestealerformbookpersistence

behavioral2

trojanspywarestealerformbookpersistence