Description
Formbook is a data stealing malware which is capable of stealing data.
Payment Advise.xlsx
General
Target
Size
Sample
Payment Advise.xlsx
337KB
211012-mqx3hacbe8
Score
10 /10
MD5
SHA1
SHA256
SHA512
2a2774f89f6ac878975ef5227cc8a92b
bfbfd645fed06b7598bfe1f583d0ba04ad943b29
54167fce5b8273b4a21f9da96c32113ebe3e5831f51aebad3ae1e97d5165f263
58faad098728b89d6e99ee6e240846b04a35047e317791a47905cd2a6117a487e9ae9a6ab6d33d1405c6be4e7cdc71b18c512929c92ed3910b8554ffe13e929d
Malware Config
Extracted
| Family | formbook |
| Version | 4.1 |
| Campaign | kzk9 |
| C2 |
http://www.yourmajordomo.com/kzk9/ |
| Decoy |
tianconghuo.club 1996-page.com ourtownmax.net conservativetreehose.com synth.repair donnachicacreperia.com tentfull.com weapp.download surfersink.com gattlebusinessservices.com sebastian249.com anhphuc.company betternatureproducts.net defroplate.com seattlesquidsquad.com polarjob.com lendingadvantage.com angelsondope.com goportjitney.com tiendagrupojagr.com self-care360.com foreignexchage.com loan-stalemate.info hrsimrnsingh.com laserobsession.com primetimesmagazine.com teminyulon.xyz kanoondarab.com alpinefall.com tbmautosales.com 4g2020.com libertyquartermaster.com flavorfalafel.com generlitravel.com solvedfp.icu jamnvibez.com zmx258.com doudiangroup.com dancecenterwest.com ryantheeconomist.com beeofthehive.com bluelearn.world vivalasplantas.com yumiacraftlab.com shophere247365.com enjoybespokenwords.com windajol.com ctgbazar.xyz afcerd.com dateprotect.com |
Targets
Target
MD5
Filesize
Payment Advise.xlsx
2a2774f89f6ac878975ef5227cc8a92b
337KB
Score
10/10
SHA1
SHA256
SHA512
bfbfd645fed06b7598bfe1f583d0ba04ad943b29
54167fce5b8273b4a21f9da96c32113ebe3e5831f51aebad3ae1e97d5165f263
58faad098728b89d6e99ee6e240846b04a35047e317791a47905cd2a6117a487e9ae9a6ab6d33d1405c6be4e7cdc71b18c512929c92ed3910b8554ffe13e929d
Tags
Signatures
-
Formbook
-
Formbook Payload
Tags
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
TTPs
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks