formbook

General

Target
eecb5ed628aa49f55850fce6c0d54f02.bin.bin
Size 13KB
Sample230507-j7mrbabf2w
SHA256 b240d9fe3e58bcbebc9f3a2b58697df0f22c4982579483be43444012e18cfa15
MD5 64374845b5a41ef64504f5896459948e
SHA1 c9736c17cf753ff170715518383f4324ddab5401
SHA512 ee5d549a5c951357be6ecd7c88aaf8a612469babca1e2d234aa3bbaea40022c0f225155bd9579445aa088c36a38402142d80b0807c714c1d017263120a188c91
SSDEEP 384:6r02PSNIhkmYVtsDQcGh0aFkoZJgs7iVHLr2:6r0gOIPYsE3h0aFkokOiVrr2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gtt8

Decoy

thesuccessbot.com
rittercivil.com
jt1.fun
d365extension.com
quqoxeq.top
visittworiverswi.com
bfprotienda.com
greenhabitsph.com
ladmere.com
clockboutiques.com
minwart.xyz
xinyuejiancai.online
eggsl.com
fetchingcandles.com
skywatiniya.com
hinkley.news
realityonlineenterprises.com
teamcroissant.com
esfera-pv.ch
herdadedosmontesbastos.com
buddhistprayers.app
talytic-one.com
capital-top.com
pawmultiverse.com
gdrop.biz
africanswers.online
amgconstruct1on.com
review.builders
findinstinct.online
leseditionsdupangolin.site
vector-sale.com
hutesmarke.shop
spacevisualmedia.com
jeweledcrown.shop
divinedivas.store
redirr.online
callifam.com
nickelinfo.com
ginghamstudio.com
launchthepodcast.com
arlisia.com
kerryshields.com
xn--o39aj5xqvflut.com
ramsgatecarwash.com
semrushfreetrails.com
rmpaclub.ru
wtpoexpo.one
amlar.xyz
downlis.top
phrasecheck.com
uk885.top
gdtrn.com
99522v.com
liftdetox2023.online
evo-omega.cloud
iccu3v.link
amd-soft1.site
containermurah.xyz
vineagency.uk
leeprintanddesign.com
bnjyjy.com
bookra-ck.com
ilyinsurance.com
texasmicroneedling.com
osmosstore.com

Targets

- Target
  300500a190d25155cc8c4d880b4017c2ad4d339944091b5eee37be754a3e9251.doc
- Size 31KB
- SHA256 300500a190d25155cc8c4d880b4017c2ad4d339944091b5eee37be754a3e9251
- MD5 eecb5ed628aa49f55850fce6c0d54f02
- SHA1 a855c7bab5a62c5f0b7618ce95e2044c00bde39e
- SHA512 53cf9f1abc9f01fbed5440c0c3d9bca2878bc0ac71f487ec43414471cd49b20d2ce1292dc54d7f690bc25ad5fe42716e817508de3c45f40b3b5057f32d74b2bd
- SSDEEP 384:cL0AbZS/DVsA5p08oGfMuWKZB9FkDoMDcUXjG1yiZyjJNPcSdwzuIzMo99zE:cwAbZS/D55pToHuWKfoDoMBiIdiNE
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook gtt8 rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2