formbook

General

Target

PO#801644.exe
Size

698KB
Sample

221127-y29q8afb86
MD5

7ab82dc302d66b8a7d413f2aa57dba4b
SHA1

1581e588673fc0b1c956a277cb0a9d0608058df1
SHA256

349e867cfbab437ac7ada1e7c25e093a180135d34dd5365f5d0e838fb8e713ac
SHA512

1611189c55d24b4361fd35de3637f6c4cfd759046f634411005b46750ac48f035738f26e5e046d20e129125a8cf95e4a59ac564bbe443ebf3e70db8a98eba8ff
SSDEEP

12288:XQ7gh/PsZ1DX/VDJSWmuSNOZZ+boU8MjrPc+nIfFm8YSu2Xpx:A7gh/Pt9m4fdnGduSu25x

Score

10^/10

Malware Config

Extracted

Family

formbook

Campaign

n2hm

Decoy

XCeG4IxNKbAl

YzJWbnC+El84nA==

KAJcdmP8yEcO5LXPCFF42Wfb

I+J+xYO95GJQWVU=

GtgxPPv3FmQmhw==

Og9NYF4xEl+j7vGTR93xvg==

506Cg07bsT0G6yK+A96H0h35V+JLkwI=

wAYXFN+pSFIXgQ==

ijzLI/f+FmQmhw==

UfT2PweNm+w8

GQWVw5aZnfF/kS5e

30BKYjua9zcA7gAwsPUngLnjyrBNEgo=

AM65OrmyFmQmhw==

VSlTVxISZ4J/kS5e

GGKj6K33SRh6e0/YzT5nQGlK5CXRqw==

B9H98cUUfX+AWOqiTA==

MxVffWOIoVnM37zrd2sTaOY=

z6bxCgG/mGhR7oDzQA==

pQgSLSRi6AK3M/PdArpX

6rRRsYuSnXx/kS5e

Targets

- Target
  
  PO#801644.exe
- Size
  
  698KB
- MD5
  
  7ab82dc302d66b8a7d413f2aa57dba4b
- SHA1
  
  1581e588673fc0b1c956a277cb0a9d0608058df1
- SHA256
  
  349e867cfbab437ac7ada1e7c25e093a180135d34dd5365f5d0e838fb8e713ac
- SHA512
  
  1611189c55d24b4361fd35de3637f6c4cfd759046f634411005b46750ac48f035738f26e5e046d20e129125a8cf95e4a59ac564bbe443ebf3e70db8a98eba8ff
- SSDEEP
  
  12288:XQ7gh/PsZ1DX/VDJSWmuSNOZZ+boU8MjrPc+nIfFm8YSu2Xpx:A7gh/Pt9m4fdnGduSu25x
Score

10^/10

formbook n2hm rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Checks computer location settings

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2