formbook

General

Target

351cf2dc95adf5b3f54c2927a9346b66114315fbd2bba17db7d8f2cbe9c8a1f3
Size

876KB
Sample

221128-dnbbaaaf95
MD5

8d1002c160dfbf7816024302ca86dd0a
SHA1

b1aabf15fb0820665e0c565acd8abe1baa0dffbf
SHA256

351cf2dc95adf5b3f54c2927a9346b66114315fbd2bba17db7d8f2cbe9c8a1f3
SHA512

c4d1b336b6656f8376c1e11e443e4aa44fe965e3363f0b0b364e47508dac54ebbd1ac3a35694054c38c1617492b9a504a6083e796c575beff6a62f6aa99c78b3
SSDEEP

1536:n9npGEch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+N:FkY

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

j13e

Decoy

qk003.com

freightfuture.co.uk

108palmerroad.com

thutienho.com

ardeoyourlife.com

bestcarszoo.com

cookingwithadele.com

anysoftware.cfd

digitalbiotech.agency

hospitalityskills.uk

fivestarsholidaylighting.com

cleandeals.net

tinysaints.online

moh-casino-fresh.club

fastlesbiandating.com

galvanizrulo.online

bbet678.com

voiceofdasouth.com

worldpetsexpo.com

parlementfleming.com

Targets

- Target
  
  351cf2dc95adf5b3f54c2927a9346b66114315fbd2bba17db7d8f2cbe9c8a1f3
- Size
  
  876KB
- MD5
  
  8d1002c160dfbf7816024302ca86dd0a
- SHA1
  
  b1aabf15fb0820665e0c565acd8abe1baa0dffbf
- SHA256
  
  351cf2dc95adf5b3f54c2927a9346b66114315fbd2bba17db7d8f2cbe9c8a1f3
- SHA512
  
  c4d1b336b6656f8376c1e11e443e4aa44fe965e3363f0b0b364e47508dac54ebbd1ac3a35694054c38c1617492b9a504a6083e796c575beff6a62f6aa99c78b3
- SSDEEP
  
  1536:n9npGEch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+N:FkY
Score

10^/10

formbook j13e rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Formbook payload
  rat
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Process spawned unexpected child process

Suspicious use of NtCreateUserProcessOtherParentProcess

Formbook payload

Blocklisted process makes network request

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2