formbook

Resubmissions

27-07-2021 23:27

210727-arpx67lxba 10

15-07-2021 07:19

210715-jb7s4tmke2 10

Sharing

Copy URL

Twitter E-mail

General

Target

http://allhomesrealestate.com.au/secured/098348893498/0399298398/0099299232/009382983.exe
Sample

210727-arpx67lxba

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

http://www.hometowncashbuyersgroup.com/kkt/

Decoy

inspirafutebol.com

customgiftshouston.com

mycreativelending.com

psplaystore.com

newlivingsolutionshop.com

dechefamsterdam.com

servicingl0ans.com

atsdholdings.com

manifestarz.com

sequenceanalytica.com

gethealthcaresmart.com

theartofsurprises.com

pirateequitypatrick.com

alliance-ce.com

wingrushusa.com

funtimespheres.com

solevux.com

antimasathya.com

profitexcavator.com

lankeboxshop.com

Targets

- Target
  
  http://allhomesrealestate.com.au/secured/098348893498/0399298398/0099299232/009382983.exe
Score

10^/10

formbook rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook Payload
  rat
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Formbook Payload

Downloads MZ/PE file

Executes dropped EXE

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

urlscan1

behavioral1