formbook

General

Target

Siparis onayi eklendi.exe
Size

816KB
Sample

220308-rhv1dsffc9
MD5

a6d1e703b380b1e716889f07cc087760
SHA1

f8abf6e3ecb0c332ace24b7ccdfcdfa50b0e968e
SHA256

50dba2f344aa086c034ce37a3aea4e70629a0eeaa8c59b2b6f6395b4969b7dc1
SHA512

658e5b8f08b3a0d4b0ef999386a4a7258d5630d3995049dd8cdd48c7992d9c201f38fc1b915817708a654a3c600dd38b602292dd4b58a51e49093f9ee3800f72

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nop

Decoy

videohm.com

panache-rose.com

alnooncars-kw.com

trueblue2u.com

brussels-cafe.com

ip2c.net

influenzerr.com

rbcoq.com

zzful.com

drainthe.com

sumaholesson.com

cursosaprovados.com

genotecinc.com

dbrulhart.com

theapiarystudios.com

kensyu-kan.com

dkku88.com

tikhyper.com

aztecnort.com

homebrim.com

Targets

- Target
  
  Siparis onayi eklendi.exe
- Size
  
  816KB
- MD5
  
  a6d1e703b380b1e716889f07cc087760
- SHA1
  
  f8abf6e3ecb0c332ace24b7ccdfcdfa50b0e968e
- SHA256
  
  50dba2f344aa086c034ce37a3aea4e70629a0eeaa8c59b2b6f6395b4969b7dc1
- SHA512
  
  658e5b8f08b3a0d4b0ef999386a4a7258d5630d3995049dd8cdd48c7992d9c201f38fc1b915817708a654a3c600dd38b602292dd4b58a51e49093f9ee3800f72
Score

10^/10

persistence formbook 3nop rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook Payload
  rat
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook Payload

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2