formbook

General

Target

862c17b77ece5eb013bbe5ced057f1a635a80d4a21c43356aed77e19fadcc0e3
Size

799KB
Sample

230110-ng4z5afg89
MD5

dfde7866b2de880f117836aa8d5b8adc
SHA1

66006bb4a7d2a35841bfea14abf1536b20f7a974
SHA256

862c17b77ece5eb013bbe5ced057f1a635a80d4a21c43356aed77e19fadcc0e3
SHA512

499f08d5830a9c55c1a3526f54d24247eb16a27145a438496dc7b42698dbb89ae8f1b2773609b2a928ec0843e4bb95778500f9fb97f4b62a2aafa31dadf9d9a6
SSDEEP

12288:OGlaKpWkdJ9pQ15Hzj4WlhjWPPvCLyZ+RvugSrmhktjxGty20qTszOFk:XlppWw9pC4pPPpkR0ymtjxUBYz0k

Score

10^/10

Malware Config

Extracted

Family

formbook

Campaign

m9ae

Decoy

nWTQpX6TYm6dfT3Lcw==

7JaBLgMm8EKn2AlTy5Ksj4Jq

yWRJIhE3viQgqEpZS3o=

ES9dFo0bytF8vlvRcg==

aX/aBZn29pD+cg==

lU64sYOZV7ZVpUy1ag==

9BpOCYAPv8L8TyIFAiTp2PSqLg==

uEJ2RyQ1BcBXfFr8kT5Z1KV0

oVM42Ury9pD+cg==

0Zl3VkcuKaY+

OjZeGI8dw67Z6eWtnOoBfoI=

ytwFn9j4i+N8nKYRSgcfh3xn5LU=

xMb1+YkOyxmbxJ53JsP7Pg==

HODQpzTBS1gVoi4X0hStKQ==

fQ417ycwD+ziKt1u0hStKQ==

nsApOqE62sA8uS735uCXVP+YcrQ=

4aobG3oZ3AHqTPs=

P2LEwJatZbQZUTayTW0=

/bopO7NR6clCfT3Lcw==

bBxRRkFY01R+20pZS3o=

Targets

- Target
  
  862c17b77ece5eb013bbe5ced057f1a635a80d4a21c43356aed77e19fadcc0e3
- Size
  
  799KB
- MD5
  
  dfde7866b2de880f117836aa8d5b8adc
- SHA1
  
  66006bb4a7d2a35841bfea14abf1536b20f7a974
- SHA256
  
  862c17b77ece5eb013bbe5ced057f1a635a80d4a21c43356aed77e19fadcc0e3
- SHA512
  
  499f08d5830a9c55c1a3526f54d24247eb16a27145a438496dc7b42698dbb89ae8f1b2773609b2a928ec0843e4bb95778500f9fb97f4b62a2aafa31dadf9d9a6
- SSDEEP
  
  12288:OGlaKpWkdJ9pQ15Hzj4WlhjWPPvCLyZ+RvugSrmhktjxGty20qTszOFk:XlppWw9pC4pPPpkR0ymtjxUBYz0k
Score

10^/10

persistence formbook m9ae rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2