formbook

General

Target
shipping documentspdf.exe
Size 652KB
Sample201216-9pepce661a
SHA256 da2b43b42246980530438667562ee8d128b2b748e817c03519157f9ba7a67ca2
MD5 ea0482a93928faf6292d6ea628164ef0
SHA1 f51f252f304fedb19f335455c87792bb008c8448
SHA512 3c12c8c947c9e055bdc2b96c8ab87fa7ca2322a0cb43c070f4c4977da507be882033f147bf43ce4f0927cc5761100d84b63fffdc1f492d0f5a6ad701949dd0c7
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

formbook

C2

http://www.maggiesdelibellyllc.com/th7/

Decoy

general-gz.com
amazonshopcustomer.info
gcfsurf.com
xn--12c8dea4ee0hn8d.com
cleanoralbr.com
cbdandhempsolutions.com
baizhiruanjian.com
wplm.online
maidservicesnw.com
apatoncreative.com
rivercityshinerva.com
thecommonroomph.com
societymixersite.club
yourbuildvideos.com
budengzhao.com
turnsee.site
evangelistbillblount.com
truegemsproperties.com
kke789.com
charmedfivetonine.com
ssgaysia.com
sfcsolar.com
timbertrailebike.com
twnakedgrocery.com
doblasur.com
weallsin.online
abrapampacr.com
rimaramana.co.uk
artsqs.com
dakory.com
atwfreelance.com
htputao.com
contaminantcoatings.com
thegrace360.com
andreacornelissen.com
jenycasanave.com
xmhzsys.com
formomentslikenoother.com
kcfatloss.com
digitalboostroadmap.com
uccbuffalo.com
sinsitysanctuary.com
logregimen.life
nailsnhang.com
zhaigoo.com
willisyourbookie.com
paialamode.com
eternity-band.com
bqf.xyz
diyleakdetection.com
catlandstore.com
ahsxjj.com
digitalmsb.com
manchesterinstitutejm.com
szlc88.com
exswor.com
biphome.com
jaxcityguide.com
lissagesurmesure.com
allstaroutfitter.com
crownpeak.xyz
bainuojianshe.com
mack-soldenfx.com
protradenow.com

Targets

- Target
  shipping documentspdf.exe
- Size 652KB
- SHA256 da2b43b42246980530438667562ee8d128b2b748e817c03519157f9ba7a67ca2
- MD5 ea0482a93928faf6292d6ea628164ef0
- SHA1 f51f252f304fedb19f335455c87792bb008c8448
- SHA512 3c12c8c947c9e055bdc2b96c8ab87fa7ca2322a0cb43c070f4c4977da507be882033f147bf43ce4f0927cc5761100d84b63fffdc1f492d0f5a6ad701949dd0c7
- MD5 SHA1 SHA512
Score

10^/10

formbook rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook Payload
  rat
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook Payload

Deletes itself

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2