formbook

General

Target
7116762d19832c3bab76f0bb22be9a5d
Size 1.5MB
Sample201117-ghdffjwbl2
SHA256 33fc5c4f2e4a32009080da98c148d44e193b25d4c99bc7122d80d26d17ea448b
MD5 1d7cc6a871aace0201c9dcb4bcc81044
SHA1 2aafeaab65bdd98cb60764e9e86656116892b566
SHA512 afbe2795650c8846415620e7ca7fef1b5bca0f50c455dc99722138133a4eb97fce685faeff59c24ac7f086b38e9ba246a6a80c326fc28c78fbecc0eda95e7b57
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

formbook

C2

http://www.sgssts.com/g456/

Decoy

ulagngu.com
newfoundlandvapes.com
sociedadesjaace.com
jobkunming.com
justgoodmn.com
autofisbo.com
werfloridaculturecoast.com
netflix12.net
melportal.guru
lovethefoodz.com
joyeriajeray.com
upsystore.com
jv041.com
duaeistikhara.com
heatzl.com
sarawutdu.com
csmlisting.com
getveyor.com
elaine-anderson.com
lacocinadezule.com
xaoikqaresede.com
paydayokey.com
207stationtrl.info
paramountnorth.com
yaoyuan.online
getzlppi.com
lamabhandup.com
erna-rosie.com
elliotduffy.com
chnl77.com
oflich.com
metameunegocio.com
jutun.net
swipeclim.info
theantiwipes.com
demirchyan.com
brightnessbd.com
sundulen.com
mundodasofia.com
guoshcxn48tb.com
microweddingorlando.com
afrorun.com
idropit.com
batesfamblog.com
horyaal24.com
jackthompsonphotography.com
rdjprints.com
lifedesignforparents.com
whsr-blog.net
aunttz.com
smmov.net
gosfordplumbersnearby.net
magickennels.net
julianavilelapsicologia.com
mckrealestate.world
win-circle101.com
jlgmjt.com
pindahsabahsarawak.com
thejennydreamy.com
synchronicitystories.com
passiontip.com
i-maskup.com
thedawnofdesigns.com
247jss.com

Targets

- Target
  7116762d19832c3bab76f0bb22be9a5d
- Size 1.5MB
- SHA256 33fc5c4f2e4a32009080da98c148d44e193b25d4c99bc7122d80d26d17ea448b
- MD5 1d7cc6a871aace0201c9dcb4bcc81044
- SHA1 2aafeaab65bdd98cb60764e9e86656116892b566
- SHA512 afbe2795650c8846415620e7ca7fef1b5bca0f50c455dc99722138133a4eb97fce685faeff59c24ac7f086b38e9ba246a6a80c326fc28c78fbecc0eda95e7b57
- MD5 SHA1 SHA512
Score

10^/10

formbook rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook Payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook Payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2