formbook

General

Target

Order Specications.exe
Size

238KB
Sample

221201-k575xagh5t
MD5

c72a49e97664c9b70f96c90495bd9224
SHA1

16ffe09a3e7376946751825dabd50534f7d2a3f2
SHA256

d4764983c36112e601465b868a7300521a22603ad82be39dc5f3a796dbafc1d3
SHA512

abbf1e9b8643889dd5115817dad630d3b7162c45d92a8fb43fa7221ce0107cf5e67908d64aaf78c2e4c84ec05077a10bf9f887e44a7a270caa5b99ba8d86c3a1
SSDEEP

6144:QBn1QmZY0qzXqPLoZiQpUNmkoRH9yrDwbP8EDHjd:gBZY0CDpUNm5dyvnk

Score

10^/10

Malware Config

Extracted

Family

formbook

Campaign

0pnv

Decoy

UeENxNlh2xN7FieUBpBO5lfm

VvcQB1LzT23hsKXRjUwN

UVO18MGf5AY=

oVF8eOF3t9kzAV7CeQ==

jxtEEGsdit4/yuxAdkB8E7LhuAs=

+Pyb8Pke6z59Fg==

pVcPluOJ7ka2WgGWOCCXNw==

5LDqHC4BbYeYhIb0

7pJjqueb8CWBTHLBDsSrEmnUoCy9ui4=

tB4+XKJLlrcv9ARTgCMfXbLhuAs=

4ZM3rO+R/mKOSkpPOQm3KYs=

sKlboNhxxswqHV+UYA==

Ld8s8DrxSqXbpro=

ZSMbPsuFz+gK3msQZB4=

W99Y4Ho8nu1UFo7EOCCXNw==

p48821D7QKXbpro=

Arvd0En7V5D3r1eofzZ8E7LhuAs=

dBc8LKJhweNJFVW7ewE=

BK3FWptVndAtAV7CeQ==

G9eJAmIDDXLur7g=

Targets

- Target
  
  Order Specications.exe
- Size
  
  238KB
- MD5
  
  c72a49e97664c9b70f96c90495bd9224
- SHA1
  
  16ffe09a3e7376946751825dabd50534f7d2a3f2
- SHA256
  
  d4764983c36112e601465b868a7300521a22603ad82be39dc5f3a796dbafc1d3
- SHA512
  
  abbf1e9b8643889dd5115817dad630d3b7162c45d92a8fb43fa7221ce0107cf5e67908d64aaf78c2e4c84ec05077a10bf9f887e44a7a270caa5b99ba8d86c3a1
- SSDEEP
  
  6144:QBn1QmZY0qzXqPLoZiQpUNmkoRH9yrDwbP8EDHjd:gBZY0CDpUNm5dyvnk
Score

10^/10

formbook 0pnv rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2