formbook

General

Target

20210113155320.exe
Size

1.0MB
Sample

210113-p4twbla2cx
MD5

0f44dd4d1edea35e84e0d2495ac90b5b
SHA1

656e86e7556720bb16c0b8d760b87b0520ed8f20
SHA256

38dac51ef91ec8f45bdb2749e2eec758b07e7b9855f2b9b25d2e59783ba9ff41
SHA512

c8aef460935dd1cd8413648be5a7ed7ddffd9204a5bb38c558816274ccd350d9ab892e5c3884bf75bacb9036cb46ebe2108c86d1e2c66cab39d807defc541e5f

Score

10^/10

Malware Config

Extracted

Family

formbook

C2

http://www.southsideflooringcreations.com/dkk/

Decoy

goldenfarmm.com

miproper.com

theutahan.com

efeteenerji.com

wellfarehealth.com

setricoo.com

enjoyablephotobooths.com

semaindustrial.com

jennywet.com

jackhughesart.com

cantgetryte.com

searko.com

zxrxhuny.icu

exoticorganicwine.com

fordexplorerproblems.com

locationwebtv.net

elinvoimainenperhe.com

mundoclik.com

nouvellenormale.com

talasnakliyat.com

Targets

- Target
  
  20210113155320.exe
- Size
  
  1.0MB
- MD5
  
  0f44dd4d1edea35e84e0d2495ac90b5b
- SHA1
  
  656e86e7556720bb16c0b8d760b87b0520ed8f20
- SHA256
  
  38dac51ef91ec8f45bdb2749e2eec758b07e7b9855f2b9b25d2e59783ba9ff41
- SHA512
  
  c8aef460935dd1cd8413648be5a7ed7ddffd9204a5bb38c558816274ccd350d9ab892e5c3884bf75bacb9036cb46ebe2108c86d1e2c66cab39d807defc541e5f
Score

10^/10

formbook rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook Payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook Payload

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2