formbook

General

Target
price quote.exe
Size 880KB
Sample201104-r355kzf3cs
SHA256 43c2d2c8e89ca3617e9521d6218b2d3c5f9e29b41b591622c658471b01b718f9
MD5 9cfe9abdcbd132846b69317eb18e549d
SHA1 ecfaf67a31c21108edc4db51dcc76f4dddc36d2d
SHA512 f371601945c03f4581e1d61214a0b9b0cf95919e459edfa1bf8c2a033dbc16eb9538767391727fb568fd650c34df78fe66bd3f762a4e0b53e1f9d13426cf440a
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

formbook

C2

http://www.onedollarreports.com/ga4/

Decoy

rivercitygoldens.com
seattlebarkery.com
jxsxdb.com
bet365o1.com
mynexthomedfw.com
scheduleyourintentions.com
vestingfacts.com
angelicasanchezpsicologa.com
constructorariedel.com
myabron.com
askthepotato.com
cuscases.com
dlrioata.com
ilikecircles.com
teamsters401kupsplan.com
79dzb.com
simoneventpros.com
cloversonglyrics.com
intansuper.com
gamefacesydney.com
rangemarketsltd.com
hobbyoo.com
miniperle.com
p17173.com
leveecrossfit.com
despoticat.com
mingchi168.com
zumoapp.xyz
outdoorsmanparadise.com
loveahoodie.net
vigorlifeproject.com
zoomforyourhealth.com
xcusebeseheje.com
avorothforever.com
cornak.xyz
99f91.com
twofishsoft.com
xn--qpr83at9ccyf9y6dksya.site
fisheye.fish
sanskaar.life
afghanmoneyexchange.com
capitalvideos.com
nunezh.com
ghhjddtu.com
emythaccelerators.com
hellocarrey.com
notify-nab.com
ninjamelody.com
qihuo119.com
anandsharmah.com
javedcoaching.com
st883.com
pawhot.com
xisburgueria.com
indiana4biden.com
foodrenewal.com
weibringcreative.com
theloveofliving.com
grandbilisim.com
pleasurezoneplaybook.com
merhomeimprovement.com
mydepressed.com
bolplasticelaguilagt.com
nikoladom.com

Targets

- Target
  price quote.exe
- Size 880KB
- SHA256 43c2d2c8e89ca3617e9521d6218b2d3c5f9e29b41b591622c658471b01b718f9
- MD5 9cfe9abdcbd132846b69317eb18e549d
- SHA1 ecfaf67a31c21108edc4db51dcc76f4dddc36d2d
- SHA512 f371601945c03f4581e1d61214a0b9b0cf95919e459edfa1bf8c2a033dbc16eb9538767391727fb568fd650c34df78fe66bd3f762a4e0b53e1f9d13426cf440a
- MD5 SHA1 SHA512
Score

10^/10

formbook persistence rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook Payload
  rat
- Deletes itself
- Modifies service
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook Payload

Deletes itself

Modifies service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2