formbook

Sharing

Copy URL Twitter E-mail

General

Target
Factura proforma # 65476_PDF.exe
Size 523KB
Sample210901-rml3gg9fp2
SHA256 b9c7b6e3537f8278ce7338f46ec1b658bb0ed0d9cf5b4c04e8d6427ded11f7b2
MD5 d23c720e800a557d04e4c0da44e57130
SHA1 58312eafc99f167d47a94fb47b6968d480ddc8fb
SHA512 760b3190e92ed5a3a426d5deb4a5654f8d94113c2408ec055c64e105070f4ff0b5efe542d16a08eef5cdc66d92254b3ebc282cc9467bdc061f51f947fc88aa86
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

Campaign

vd9n

http://www.constructioncleanup.pro/vd9n/

Decoy

theunwrappedcollective.com
seckj-ic.com
tyresandover.com
thetrophyworld.com
fonggrconstruction.com
hopiproject.com
sktitle.com
charlotteobscurer.com
qjuhe.com
girlzglitter.com
createmylawn.com
hempcbgpill.com
zzdfdzkj.com
shreehariessential.com
226sm.com
getcupscall.com
neuralviolin.com
sanskaar.life
xn--fhqrm54yyukopc.com
togetherx4fantasy5star.today
buyonlinesaree.com
percyshandman.site
hatchethangout.com
rugpat.com
zen-gizmo.com
vipmomali.com
lacerasavall.cat
aqueouso.com
mkolgems.com
sevenhundredseventysix.fund
fotografhannaneret.com
mitravy.com
bmtrans.net
linterpreting.com
izquay.com
sawaturkey.com
marche-maman.com
eemygf.com
animenovel.com
travelssimply.com
montecitobutterfly.com
volebahis.com
daniela.red
ramseyedk12.com
leyterealestate.info
patriotstrong.net
vkgcrew.com
nadhiradeebaazkiya.online
hotelcarre.com
myfabulouscollection.com
stellantis-luxury-rent.com
hn2020.xyz
emilyscopes.com
lotosouq.com
lovecord.date
stconstant.online
volkite-culverin.net
allwaysautism.com
sheisnatashasimone.com
sepantaceram.com
ishopgrady.com
lifestorycard.com
sexybbwavailable.website
domainbaycapital.com

Targets

- Target
  Factura proforma # 65476_PDF.exe
- Size 523KB
- SHA256 b9c7b6e3537f8278ce7338f46ec1b658bb0ed0d9cf5b4c04e8d6427ded11f7b2
- MD5 d23c720e800a557d04e4c0da44e57130
- SHA1 58312eafc99f167d47a94fb47b6968d480ddc8fb
- SHA512 760b3190e92ed5a3a426d5deb4a5654f8d94113c2408ec055c64e105070f4ff0b5efe542d16a08eef5cdc66d92254b3ebc282cc9467bdc061f51f947fc88aa86
- MD5 SHA1 SHA512
Score

10^/10

formbook vd9n rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook Payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook Payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2