formbook

General

Target

Urgent Request For Quotation.exe
Size

836KB
Sample

221207-fy9ypsbd6t
MD5

d88119055f1234dd4459d7347b045033
SHA1

7b5e72f10cb6c61f6cc3deb205d86c866055ffa0
SHA256

590277f960d74add2860c7332ae427eaea968bdf3bb4d5a8da5563a3115b16f7
SHA512

8fa23415012d012db81b9940a8a1c17c0de04d408702de1d345b31ab43d9b64f5a97894d5af82d559979b7656716843862d3f9feec67f366e074bcff6d8bcaa6
SSDEEP

12288:FcGHKlNiKXd9nfj0ygyDyl/56XUGQ+Pb+jjmaZgKZ/nXt7virmWhlGLaQYI:e3ieb0yGxmPQUK

Score

10^/10

Malware Config

Extracted

Family

formbook

Campaign

snky

Decoy

AiMFvkl6+A4HEgZ99q5x4naN7lGmvJo=

tvj/KUTKeKgxszIemQ==

DTrTokBrjB5leF4=

tPeTOuIjJPtH

taxtMdIygEdpskxzOQ2ZjoAEeA==

CxLuaKAFRrJyuIqQUPbhZw==

Tn4fapT5kPmk1H0gpXQ=

h5p8hDqGSiRzdSbV

i3lg8tbRNRU6jC9pQSOxzHYZgpbnOKBx

EwbfBo6m+UXU2qaVUPbhZw==

WpeenFSMquJ3xXD1/b43

niV5qTFu3tfmcgrI

fqyyyElbdxWswJ7A

Lh7o92ZOr4ghbwvK

Y2RYMDue4x+KszIemQ==

lN3Y3z5AS85eah1MDvfFQQA=

uq+Oqh8MNRxHOOkqA9lqYEZZhJU=

FEtGDeGnnRoSQEM=

TkMlruotvsmtpFwg6shr03LjwMWGow==

7PGx8hNMep8EMj5Q39dsq16IbbaIrA==

Targets

- Target
  
  Urgent Request For Quotation.exe
- Size
  
  836KB
- MD5
  
  d88119055f1234dd4459d7347b045033
- SHA1
  
  7b5e72f10cb6c61f6cc3deb205d86c866055ffa0
- SHA256
  
  590277f960d74add2860c7332ae427eaea968bdf3bb4d5a8da5563a3115b16f7
- SHA512
  
  8fa23415012d012db81b9940a8a1c17c0de04d408702de1d345b31ab43d9b64f5a97894d5af82d559979b7656716843862d3f9feec67f366e074bcff6d8bcaa6
- SSDEEP
  
  12288:FcGHKlNiKXd9nfj0ygyDyl/56XUGQ+Pb+jjmaZgKZ/nXt7virmWhlGLaQYI:e3ieb0yGxmPQUK
Score

10^/10

formbook snky rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2