Description
Formbook is a data stealing malware which is capable of stealing data.
Inv.exe
General
Target
Size
Sample
Inv.exe
326KB
210113-gaab1e7kge
Score
10 /10
MD5
SHA1
SHA256
SHA512
a3aba7d40da6c8c86e4e8d035803f314
469b36f05939d6ec6457f1b72ba9f6c7a960be06
1f94eb81e3cde4f677fd210e1ff7f5d06987cbdc2fa7de79e28b224e49244b40
2cfa59a865a8292b98fb3e8e6ae79a4613d773be87c927ba4cc8e0f034010c0e5ebd0b85a74ca02ef59d47335908bcc610a597bc9cbfbfaaf364d76f51fff2fc
Malware Config
Extracted
| Family | formbook |
| C2 |
http://www.nationshiphop.com/hko6/ |
| Decoy |
apartmentsineverettwa.com forritcu.net hotroodes.com skinnerttc.com royaltrustmyanmar.com adreslog.com kaysbridalboutiques.com multitask-improvements.com geniiforum.com smarthomehatinh.asia banglikeaboss.com javlover.club affiliateclubindia.com mycapecoralhomevalue.com comparamuebles.online newrochellenissan.com nairobi-paris.com fwk.xyz downdepot.com nextgenmemorabilia.com achonabu.com stevebana.xyz jacmkt.com weownthenight187.com divshop.pro wewearceylon.com skyreadymix.net jaffacorner.com bakerlibra.icu femalecoliving.com best20banks.com millcityloam.com signature-office.com qlifepharmacy.com dextermind.net fittcycleacademy.com davidoff.sucks 1033393.com tutorsboulder.com bonicc.com goodberryjuice.com zhaowulu.com teryaq.media a-zsolutionsllc.com bitcoincandy.xyz cfmfair.com annefontain.com princesssexyluxwear.com prodigybrushes.com zzhqp.com |
Targets
Target
MD5
Filesize
Inv.exe
a3aba7d40da6c8c86e4e8d035803f314
326KB
Score
10 /10
SHA1
SHA256
SHA512
469b36f05939d6ec6457f1b72ba9f6c7a960be06
1f94eb81e3cde4f677fd210e1ff7f5d06987cbdc2fa7de79e28b224e49244b40
2cfa59a865a8292b98fb3e8e6ae79a4613d773be87c927ba4cc8e0f034010c0e5ebd0b85a74ca02ef59d47335908bcc610a597bc9cbfbfaaf364d76f51fff2fc
Tags
Signatures
-
Formbook
-
Formbook Payload
Tags
-
Deletes itself
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks