formbook | caa38badb67b8cb6178a92166c376185970eac84ec3ff595ca85d3c4cd23c78d | Triage

Sharing

General

Target

caa38badb67b8cb6178a92166c376185970eac84ec3ff595ca85d3c4cd23c78d
Size

28KB
Sample

220727-zrt4fsdcb9
MD5

170cd35a3dddf342730c34d4e4acbd83
SHA1

213e9a7b12c507cf72db02775fc276962558ae58
SHA256

caa38badb67b8cb6178a92166c376185970eac84ec3ff595ca85d3c4cd23c78d
SHA512

a06bb70523179bd97bc7a01ab5b345645af90ceacc38ace68d952c432cd2a64f2934d86d834d9e3d06be68799ac51d72bc514fc5b34500cb954c74e93a7e63ac

Score

10^/10

formbook s4s9 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s4s9

Decoy

qianyuandianshang.com

bernardklein.com

slhomeservices.com

findasaas.com

janellelancaster.xyz

umkpro.site

nr6949.online

mersquare.club

lanariproperties.com

3rdeyefocused.com

giftexpress8260.xyz

hilleleven.xyz

beajod.com

kosazs.online

ishare.team

mb314.com

xjjinxingda.com

ayekooprojectamazing.com

ballsybanter.com

todayshoppingbd.com

Targets

- Target
  
  caa38badb67b8cb6178a92166c376185970eac84ec3ff595ca85d3c4cd23c78d
- Size
  
  28KB
- MD5
  
  170cd35a3dddf342730c34d4e4acbd83
- SHA1
  
  213e9a7b12c507cf72db02775fc276962558ae58
- SHA256
  
  caa38badb67b8cb6178a92166c376185970eac84ec3ff595ca85d3c4cd23c78d
- SHA512
  
  a06bb70523179bd97bc7a01ab5b345645af90ceacc38ace68d952c432cd2a64f2934d86d834d9e3d06be68799ac51d72bc514fc5b34500cb954c74e93a7e63ac
Score

10^/10

formbook s4s9 rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

formbooks4s9ratspywarestealertrojan