formbook

General

Target
e85a39079d963bca45d0679b1920cfc3446d26dddc6eb1a243d1070b5b94f5f1
Size 345KB
Sample220625-lfansahab3
SHA256 e85a39079d963bca45d0679b1920cfc3446d26dddc6eb1a243d1070b5b94f5f1
MD5 6e1e18eaf5207fab680fad3eda2d2b0c
SHA1 b7f157c665f3873778e3e186b4ffa3581a4af503
SHA512 8ec6de478183920473cee55790f83785ed26a2bf29ad908e233220a4c5c0e7884140c7b694ecc273a3de0a0082bb266e50d9a13b3a0f3cf76a96233e5df51fee
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

e56

Decoy

kuedmann.com
carepathpt.com
nashtradehouse.com
tendersmeet.com
paulhumber.com
themanagementboss.com
dressmakertoronto.com
technologie-numerique.com
zyrtsz.com
cleaning25.com
it-kd.com
utcpof.men
960641.com
cew45.com
sxdswkj.com
light-geek.com
reverenddrtwcarson.com
sedefdenkurtul.life
sivydubu.info
sierra-sur.com
k7umd.com
best-tech-gadgets.com
shop-basket.com
creoleenvie.net
lp-world.com
mamajuku.com
nvrende.com
norasquare.com
bettermethodpowerwashing.com
0jda.faith
esportstutorial.com
sa720.com
russiawillbefree.com
pinjamankl.loan
copyrightinfringementgroup.com
suna.ltd
zfxy8888.com
laviesanseffort.com
lavangalleries.com
agentpalapp.com
isum.ltd
nn.pictures
boycottchickfila.com
suckerforstuff.com
ixnubo.info
radiogardeshgari.com
stairs-yar.com
abetensia.com
wdplay88.com
wsczmd.com
realbelle.com
federicocorradi.net
coachingforleaders.online
qualitycoachrv.net
indianaerofun.com
studer.email
xpj9028.com
led.pet
zhoushan.ink
tzzjsk.com
peachykin.com
maofengmall.com
devendrabhaiji.com
thedogartillery.com
nyoxibwer.com

Targets

- Target
  e85a39079d963bca45d0679b1920cfc3446d26dddc6eb1a243d1070b5b94f5f1
- Size 345KB
- SHA256 e85a39079d963bca45d0679b1920cfc3446d26dddc6eb1a243d1070b5b94f5f1
- MD5 6e1e18eaf5207fab680fad3eda2d2b0c
- SHA1 b7f157c665f3873778e3e186b4ffa3581a4af503
- SHA512 8ec6de478183920473cee55790f83785ed26a2bf29ad908e233220a4c5c0e7884140c7b694ecc273a3de0a0082bb266e50d9a13b3a0f3cf76a96233e5df51fee
- MD5 SHA1 SHA512
Score

10^/10

formbook e56 persistence rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook Payload
  rat
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook Payload

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2