Description
Formbook is a data stealing malware which is capable of stealing data.
INQ_42-4I090.xlsx
General
Target
Size
Sample
INQ_42-4I090.xlsx
360KB
211023-fppleacba7
Score
10 /10
MD5
SHA1
SHA256
SHA512
34f843f6f1b3011a7cdb63753853ef58
922ebd64f7ffe9d8548d467b631f6bdf2ede6106
fbdb8f368721ccfea456f2e6f232304acff371bdb62a5140b9fc44bd224e0d57
ad644134a1af636fc794b49bd35fecd5c3dc778a3a2d2503b3cb3285da43c26b9e133f0ba6bc7f049032ab395e3e0d41bd371ab30b5ef18515b7390c39f7be73
Malware Config
Extracted
| Family | formbook |
| Version | 4.1 |
| Campaign | kzk9 |
| C2 |
http://www.yourmajordomo.com/kzk9/ |
| Decoy |
tianconghuo.club 1996-page.com ourtownmax.net conservativetreehose.com synth.repair donnachicacreperia.com tentfull.com weapp.download surfersink.com gattlebusinessservices.com sebastian249.com anhphuc.company betternatureproducts.net defroplate.com seattlesquidsquad.com polarjob.com lendingadvantage.com angelsondope.com goportjitney.com tiendagrupojagr.com self-care360.com foreignexchage.com loan-stalemate.info hrsimrnsingh.com laserobsession.com primetimesmagazine.com teminyulon.xyz kanoondarab.com alpinefall.com tbmautosales.com 4g2020.com libertyquartermaster.com flavorfalafel.com generlitravel.com solvedfp.icu jamnvibez.com zmx258.com doudiangroup.com dancecenterwest.com ryantheeconomist.com beeofthehive.com bluelearn.world vivalasplantas.com yumiacraftlab.com shophere247365.com enjoybespokenwords.com windajol.com ctgbazar.xyz afcerd.com dateprotect.com |
Targets
Target
MD5
Filesize
INQ_42-4I090.xlsx
34f843f6f1b3011a7cdb63753853ef58
360KB
Score
10/10
SHA1
SHA256
SHA512
922ebd64f7ffe9d8548d467b631f6bdf2ede6106
fbdb8f368721ccfea456f2e6f232304acff371bdb62a5140b9fc44bd224e0d57
ad644134a1af636fc794b49bd35fecd5c3dc778a3a2d2503b3cb3285da43c26b9e133f0ba6bc7f049032ab395e3e0d41bd371ab30b5ef18515b7390c39f7be73
Tags
Signatures
-
Formbook
-
Formbook Payload
Tags
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
TTPs
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks