formbook

General

Target

Shipping docs xlsx.exe
Size

239KB
Sample

221207-wgaqaafe73
MD5

61672650363565ad7ce71c5a261a5e7e
SHA1

da70e0ed691217615c57963c58e18de927c13294
SHA256

37572cb6f2bd3ef772a437f0e91cd813bfd270988f205c7a24f200ba4df6a609
SHA512

17b7867c3329a1ccd514cb265622d9bcf8a817d29b49e7c9fd12e49ae905ef09683da32e41ed57054f0451b3fc7f562ad999c59558948659e63cfe17f23fc824
SSDEEP

6144:QBn10ffIoo3VeRy65qQvT1GLwbTWYM89y7rOjPwA:gSR5qubqS96SD

Score

10^/10

Malware Config

Extracted

Family

formbook

Campaign

n2hm

Decoy

XCeG4IxNKbAl

YzJWbnC+El84nA==

KAJcdmP8yEcO5LXPCFF42Wfb

I+J+xYO95GJQWVU=

GtgxPPv3FmQmhw==

Og9NYF4xEl+j7vGTR93xvg==

506Cg07bsT0G6yK+A96H0h35V+JLkwI=

wAYXFN+pSFIXgQ==

ijzLI/f+FmQmhw==

UfT2PweNm+w8

GQWVw5aZnfF/kS5e

30BKYjua9zcA7gAwsPUngLnjyrBNEgo=

AM65OrmyFmQmhw==

VSlTVxISZ4J/kS5e

GGKj6K33SRh6e0/YzT5nQGlK5CXRqw==

B9H98cUUfX+AWOqiTA==

MxVffWOIoVnM37zrd2sTaOY=

z6bxCgG/mGhR7oDzQA==

pQgSLSRi6AK3M/PdArpX

6rRRsYuSnXx/kS5e

Targets

- Target
  
  Shipping docs xlsx.exe
- Size
  
  239KB
- MD5
  
  61672650363565ad7ce71c5a261a5e7e
- SHA1
  
  da70e0ed691217615c57963c58e18de927c13294
- SHA256
  
  37572cb6f2bd3ef772a437f0e91cd813bfd270988f205c7a24f200ba4df6a609
- SHA512
  
  17b7867c3329a1ccd514cb265622d9bcf8a817d29b49e7c9fd12e49ae905ef09683da32e41ed57054f0451b3fc7f562ad999c59558948659e63cfe17f23fc824
- SSDEEP
  
  6144:QBn10ffIoo3VeRy65qQvT1GLwbTWYM89y7rOjPwA:gSR5qubqS96SD
Score

10^/10

formbook n2hm rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2