formbook

General

Target
quote.exe
Size 814KB
Sample230207-vn5cssga61
SHA256 0802394968eda97506836e12c3deb32af74ad1ffcc86b22e4d654d10b865241c
MD5 6df9213dd65135dd35c056943d5c8034
SHA1 8a248204ed3dc2b22d4c72cf849d9f9e7cbe42cb
SHA512 890993bbea43465e04417cc8bed784734c7e723dcbf5cb48de953d8bd321e1c57254068354dbd9b46f3968762d18cfd81ebaa6af18c70e3916b487fc1dc7dbdb
SSDEEP 12288:psawHRr/CB06KuLphq8KoPZOGmyyGIuWo4A5RGgMVSAx6dEeT4X3WRX0XFHbDDlG:psawxO5dhqT82AESAfE4X3QX8Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

o12i

Decoy

dbepa.com
isenseot.com
trainwithmichelle.co.uk
eqhired.com
crushthehacker.com
fineartintimates.com
alphabet1x.com
gdnfys.com
bauav.com
frommm.com
easyquicklabs.com
cat-cazino.buzz
lowpriceaxis.com
brendaalonso.net
darkblissclothing.com
betrar355.com
help-web.ru
asxoffice.com
cityofparistx.com
beriterusyah.click
neswopi.xyz
ceucavy.top
cy56v.beauty
faunapetsstore.com
ghazouli.shop
fawazgruosi.co.uk
dormirbedandfoam.com
laumangve.net
diqiumaoyi.com
comfortmedial.com
wigansignservices.uk
buildinspain.com
handyjamconstruction.com
dein-wandelkreis.com
55yyy.net
kamencani.com
28984.uk
gappst.com
humanograma.com
23554189027.com
denizgroupco.com
3880365.com
ihdgyengd.xyz
leka.fun
beingabroad.store
herokids.africa
efefdivergent.buzz
45gp.xyz
healhousepg.com
lrhyqygl.com
irenovationmedia.com
kostadmed.com
chiaseed-food.click
jiesportshero.com
kev4hay.com
junoo.tech
ilovedopney.com
herewu.com
curatorsnotes.press
celiconwellness.com
amenergiasolar.com
bibleproject2020.com
bcbxdsh.com
imaglnationlibrary.com
hillsdiehavens.co.uk

Targets

- Target
  quote.exe
- Size 814KB
- SHA256 0802394968eda97506836e12c3deb32af74ad1ffcc86b22e4d654d10b865241c
- MD5 6df9213dd65135dd35c056943d5c8034
- SHA1 8a248204ed3dc2b22d4c72cf849d9f9e7cbe42cb
- SHA512 890993bbea43465e04417cc8bed784734c7e723dcbf5cb48de953d8bd321e1c57254068354dbd9b46f3968762d18cfd81ebaa6af18c70e3916b487fc1dc7dbdb
- SSDEEP 12288:psawHRr/CB06KuLphq8KoPZOGmyyGIuWo4A5RGgMVSAx6dEeT4X3WRX0XFHbDDlG:psawxO5dhqT82AESAfE4X3QX8Z
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook o12i rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2