formbook | dcbd4c17d24d6939e1de666b9f4558d6a73cd8b892ad3c0a08ca6ced2896204a | Triage

Submit
Reports

Overview

overview

Static

static

1

DHL Docume...24.xls

windows7-x64

DHL Docume...24.xls

windows10-2004-x64

1

Sharing

General

Target

DHL Documents R129724.xls
Size

1.0MB
Sample

230404-stnacsaa9v
MD5

d4909a2624cff06b9ee5875f9775c77b
SHA1

f92decc4441e5e5f2d4305fb289c4fee75760482
SHA256

dcbd4c17d24d6939e1de666b9f4558d6a73cd8b892ad3c0a08ca6ced2896204a
SHA512

dbd71828e8e3f37a43d3f5774afdfe8340a6302560690e49e304a9a82ff4e568482d3c71126669fd74b091444104a3f2530ae290b83348bafd8bfd91b2c351f9
SSDEEP

12288:1HaFiKXKl0qUu9VnewffDArDqUu9VneqqUu9Vnejf2PArgqUu9VneEArAZX1ozHg:0LKlyu9Vyu9V/u9V9u9VDSs

Score

10^/10

formbook sa79 rat spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

DHL Documents R129724.xls

Resource

win7-20230220-en

formbook sa79 rat spyware stealer trojan

windows7-x64

22 signatures

150 seconds

Behavioral task

behavioral2

Sample

DHL Documents R129724.xls

Resource

win10v2004-20230220-en

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sa79

Decoy

aidigify.com

angelavamundson.xyz

glicotoday.fun

agencyforbuyers.com

blacklifecoachquiz.com

4e6aqw.site

huawei1990.com

diyetcay.online

chesirechefs.co.uk

generalhospitaleu.africa

hfewha.xyz

lemons2cents.com

rahilprakash.com

kave.tech

netlexfrance.net

youthexsa.africa

car-covers-40809.com

bambooactive.store

fotobugil48.com

kuhler.club

ftyon.xyz

cramyact1.info

finefrenchcaviar.co.uk

158029.xyz

doneswanneeds.com

campanianetwork.online

trade.boo

totaltrace.co.uk

grandgoldrange.africa

oliviahodges04.uk

eckiahe.club

imagebeuty.com

kutxa-incidencias.info

goodnewz.africa

alampsoldes.com

xuanliuchushaqi.com

leaf-spa.net

artblocks.bio

estres0.com

hcoltun.xyz

boostonsquelette.com

bettygrablerm.com

tulipbaddie.com

binosresidence.africa

sunnyola.com

guangxisangna.com

8888m.net

alaamriproducts.com

busy-people-gifts.com

i-sell-fun.com

grandnatali.ru

allstarssport.co.uk

cloud-spartan.co.uk

vitamincbd.africa

winelandsphotography.africa

ndyc.africa

cvbetter.co.uk

bestinvestment-trust.info

lblpackagestore.com

grabacionescaseras.com

fixmypothole.com

combatwash.com

brittnybuttondesign.net

eerieytorrent.com

heguangxueyuan.com

Targets

- Target
  
  DHL Documents R129724.xls
- Size
  
  1.0MB
- MD5
  
  d4909a2624cff06b9ee5875f9775c77b
- SHA1
  
  f92decc4441e5e5f2d4305fb289c4fee75760482
- SHA256
  
  dcbd4c17d24d6939e1de666b9f4558d6a73cd8b892ad3c0a08ca6ced2896204a
- SHA512
  
  dbd71828e8e3f37a43d3f5774afdfe8340a6302560690e49e304a9a82ff4e568482d3c71126669fd74b091444104a3f2530ae290b83348bafd8bfd91b2c351f9
- SSDEEP
  
  12288:1HaFiKXKl0qUu9VnewffDArDqUu9VneqqUu9Vnejf2PArgqUu9VneEArAZX1ozHg:0LKlyu9Vyu9V/u9V9u9VDSs
Score

10^/10

formbook sa79 rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Exploitation for Client Execution

Persistence

Privilege Escalation

Defense Evasion

Scripting

Modify Registry

Credential Access

Discovery

System Information Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

formbooksa79ratspywarestealertrojan

behavioral2

© 2018-2024

Terms | Privacy