formbook

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Variant.Tedy.263659.21975.9030.exe
Size 735KB
Sample221223-kfahcagb84
SHA256 e784a935fe7202811e85a6d032f0787f563426c30ac222377b3a5eeb66f157b3
MD5 db874d98fe9d14d474b72b50f85e8b5d
SHA1 9bdcff250132ff0917765787206e479d17252402
SHA512 944f19dfbab0f9d8768a29bc4a50594ce15aabb1650f7a2dfd6fcdfc311fa92cf63ea8bdb9c2e8cd943cae9538d09956af782a80a2da043407016e5da89163ea
SSDEEP 12288:jh8x/8tkf+mDXttarruVBDUJvnVhyoy3XtqowB979LSxEFGIiSGyD3m6D/Yd8FzY:j6x/MaQow7RmEMIiS9DZAdAH80
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

Campaign

oi05

Decoy

fluidavail.online
blchain.tech
kyocera.website
sangmine.xyz
thepolicyjacket.info
ssvhelpman.net
y-t-design.com
eminentabroad.com
codingcamp.store
bester.capital
tanjiya23.site
bheniamyn.dev
top5monitor.com
bit-prim.trade
airstreamsocialclub.com
darkwarspod.com
zazisalesdistribution.com
vivolentlo.online
daftburo.net
elemangelsin.xyz
chasewildfire.buzz
olioubnajo.buzz
agoura.dental
ky4352.com
finechoice.mobi
studioarchadroit.com
5009townesouth.com
tik454register.xyz
divaresesaat.xyz
projektwrestling.com
krystalclearmemories.net
vinaychhaparia.com
sodexosupplychain.info
uudai.store
demontya.site
cloudydad.cloud
mewzom.online
20010906.xyz
epuken.link
saludaldia.tech
generto.com
mbenzmotorsport.com
voidssl.life
elbetolacakbirgece10.com
cdncleaningservices.com
kuzs248.top
verus.website
wisefocus.net
xn--nergie-de-gaia-9jb.com
wowsportsbet.com
vhkopiu.top
shopify-postmaster15.info
lysiimmobilier.site
princess.express
betebrands.com
6tldsuoacvrlwc1g4i.top
labucarimini.net
hogushinotakumi.com
turnhappy.shop
geenpaii.xyz
pyrrhadev.xyz
minhasaudeelevada.com
oblk.pics
recursosdijitales.com
vivencie.shop

Targets

- Target
  SecuriteInfo.com.Variant.Tedy.263659.21975.9030.exe
- Size 735KB
- SHA256 e784a935fe7202811e85a6d032f0787f563426c30ac222377b3a5eeb66f157b3
- MD5 db874d98fe9d14d474b72b50f85e8b5d
- SHA1 9bdcff250132ff0917765787206e479d17252402
- SHA512 944f19dfbab0f9d8768a29bc4a50594ce15aabb1650f7a2dfd6fcdfc311fa92cf63ea8bdb9c2e8cd943cae9538d09956af782a80a2da043407016e5da89163ea
- SSDEEP 12288:jh8x/8tkf+mDXttarruVBDUJvnVhyoy3XtqowB979LSxEFGIiSGyD3m6D/Yd8FzY:j6x/MaQow7RmEMIiS9DZAdAH80
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook oi05 rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Checks computer location settings

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2