formbook

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.W32.MSIL_Agent.GJP.gen.Eldorado.2531.21348.exe
Size 768KB
Sample231004-avmfcaaa72
SHA256 b835220d18074195e2df569e8088470b7f400c334aef1dd54dfe30e2019dab7a
MD5 488d231b6413d29ccafe3caacff23c6b
SHA1 285c09c57569315c35f2cb65ab623e3d54c57052
SHA512 5c51b580b63dc446fbe073be17098688da9056e13926bf5c9f2de28f58f67ac4fa1a27c0f206a54e0b70d3dc71b6fba7bb8ce8b487b33c4956bba998da7acb2f
SSDEEP 24576:FBq1C7b1p5DjQxwdBuTb3pGxeKguK5/p9AEjuVGi+VG4U7M8vefwtqhJr:XJIfwtq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

Campaign

ge58

Decoy

squibbs10year.com
merchallqualitystorecenter.com
avylw.com
chubbysamericangrill.com
passionforfashionbyshivani.com
bergfors.email
hearing-tests-30868.bond
seattleaminals.net
gbxibeb.com
mhbalancenow.com
goliathhomesgroup.com
paradigmayazilim.com
esgaspol.com
qzoneqyt.shop
aieibook.com
best-rudderstack.life
cpd888.com
231564515.top
fairytailfigures.online
smartmarketadmin.com
babysitter-service-54850.bond
ylyyz.top
g4yyxgpkq6od.top
progames.space
e73fa.top
vogueunique.com
49d8y5.top
migu-store.com
khidvm.xyz
hossam-mahmoud.tech
cyber--bullet.com
ale25qnu.monster
az-koala.xyz
twostoneshotels.com
centerpointarcher.com
zrzaz.cfd
adult-match.com
g2f1nb.top
zarabelgium.com
iburki.com
gamebaidoithuong91.net
mundofinancieromaestro.site
thebronconationa.com
slkoxyz.site
shahd.site
grahaspinrtp.site
aestheticlabelmedspa.com
unityunionbank.com
zkyg365.com
reinventyourlivingspace.com
thisisforyoupodcast.com
bh4p.lat
bestfootballsource.com
justbaseline.com
rumahbagi.com
vvqpuf.top
yuantushe.com
chip-mixer.net
whiteglovecarriernetwork.com
e0dy.lat
yazan.best
dgodontoeestetica.online
glaukos-irock.com
singhaimotocorp.com
mrc-brands.online

Targets

- Target
  SecuriteInfo.com.W32.MSIL_Agent.GJP.gen.Eldorado.2531.21348.exe
- Size 768KB
- SHA256 b835220d18074195e2df569e8088470b7f400c334aef1dd54dfe30e2019dab7a
- MD5 488d231b6413d29ccafe3caacff23c6b
- SHA1 285c09c57569315c35f2cb65ab623e3d54c57052
- SHA512 5c51b580b63dc446fbe073be17098688da9056e13926bf5c9f2de28f58f67ac4fa1a27c0f206a54e0b70d3dc71b6fba7bb8ce8b487b33c4956bba998da7acb2f
- SSDEEP 24576:FBq1C7b1p5DjQxwdBuTb3pGxeKguK5/p9AEjuVGi+VG4U7M8vefwtqhJr:XJIfwtq
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook ge58 persistence rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2