formbook | 200c25e3ad1dd6d924455a89035c1c677c7b319a89e3e9fac0499514175b67fc | Triage

Sharing

General

Target

200c25e3ad1dd6d924455a89035c1c677c7b319a89e3e9fac0499514175b67fc
Size

371KB
Sample

220111-axhj6sfbbm
MD5

e6fb6a28bf4e2a128876d9f4bddcb0e5
SHA1

056ba8bbc6045576bfe8bc2526bf70942a3e4286
SHA256

200c25e3ad1dd6d924455a89035c1c677c7b319a89e3e9fac0499514175b67fc
SHA512

a9f8a7a28e07f7dcc4824c34ac89002d589eab2daa0244992fd7617f9db1cb32cc7791791fb6d4e8d8c58298514bc4d7a215a0b408dde24a65be68e68233045e

Score

10^/10

formbook h4d0 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

h4d0

Decoy

onlinefinejewelry.com

samstringermusic.com

beam-lettings.info

optimumcoin.xyz

fasa.xyz

creativedime.com

eihncuz.online

griffin2008.top

europcarlive.com

jxhcar.com

museumsshop.international

bonolaboral-lnterbank.com

kelebandis.xyz

hiddenlakeranch.net

carelessyouth.com

jfkilfoil.store

potok-it-ua.site

magdulemediation.com

shakadal.xyz

coastconstructionfl.com

Targets

- Target
  
  200c25e3ad1dd6d924455a89035c1c677c7b319a89e3e9fac0499514175b67fc
- Size
  
  371KB
- MD5
  
  e6fb6a28bf4e2a128876d9f4bddcb0e5
- SHA1
  
  056ba8bbc6045576bfe8bc2526bf70942a3e4286
- SHA256
  
  200c25e3ad1dd6d924455a89035c1c677c7b319a89e3e9fac0499514175b67fc
- SHA512
  
  a9f8a7a28e07f7dcc4824c34ac89002d589eab2daa0244992fd7617f9db1cb32cc7791791fb6d4e8d8c58298514bc4d7a215a0b408dde24a65be68e68233045e
Score

10^/10

formbook h4d0 rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook Payload
  rat
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

formbookh4d0ratspywarestealertrojan