formbook

General

Target

GOLvTSVQTD8nam7.exe
Size

793KB
Sample

210111-bx8b1fhjdn
MD5

d2d88b23540084d5ddcb24504cd741a5
SHA1

8d86e3014c50a111b39a3d86d181fbc2eea128c6
SHA256

ca179c01ce38a54fa4659496a086973f3fc99870230a725fc782c71453ac5f54
SHA512

8e5659dc9330989f1273edce33f229c5ee3e2537332e830a71b51fc3c1fb2735ac70f66c6d6274723ee9d74d5931eeb128c32239af7a09ced9cc2add91d7bf98

Score

10^/10

Malware Config

Extracted

Family

formbook

C2

http://www.badstar.net/tmz/

Decoy

easywebplacenetlaramie.com

kushions.today

wallsbilplat.com

csgetdegrees.com

wujuenong.net

bhsentertainmentnews.com

worpar.com

ivappsglobal.com

talktogiamfoods.com

nagoyasteakandsushi.com

blockchaininfo.site

unitylinkonlie.com

sofiavoz.com

livesportsite.com

wishesandmessages.com

diningroomspaintcolorsideas.com

landnlushscents.com

metrosdahospitals.com

coast2coastrent.com

turkhristiyanbirligi.com

Targets

- Target
  
  GOLvTSVQTD8nam7.exe
- Size
  
  793KB
- MD5
  
  d2d88b23540084d5ddcb24504cd741a5
- SHA1
  
  8d86e3014c50a111b39a3d86d181fbc2eea128c6
- SHA256
  
  ca179c01ce38a54fa4659496a086973f3fc99870230a725fc782c71453ac5f54
- SHA512
  
  8e5659dc9330989f1273edce33f229c5ee3e2537332e830a71b51fc3c1fb2735ac70f66c6d6274723ee9d74d5931eeb128c32239af7a09ced9cc2add91d7bf98
Score

10^/10

formbook rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook Payload
  rat
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook Payload

Deletes itself

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2