formbook | 571b79715074fca09bf065bf7eefa5ae1e827da26d6241365d77ba6d337cf2b8 | Triage

Resubmissions

23-03-2024 00:31

240323-at9jgsdf6y 10

19-03-2024 06:37

240319-hdwaxsce33 10

Sharing

General

Target

d573453967dac41998011aaaa662acf4
Size

483KB
Sample

240323-at9jgsdf6y
MD5

d573453967dac41998011aaaa662acf4
SHA1

3406d434dd688db8ea050ba90143293c36cff270
SHA256

571b79715074fca09bf065bf7eefa5ae1e827da26d6241365d77ba6d337cf2b8
SHA512

febbb66d257cd864bfa0172b0b308e392a2b82dd837df14e656a2211c779e8c3beee5a401bfa585379b9a5b6f12a0758df185ab648509bb4cf8c657b4bd91fd8
SSDEEP

6144:CIFhuSYWFYgrKsUc3y2WnO1xzcWmZXe2rkwnbo60T21BOcCSrYDEgfje5ig1ef9h:Ph8Mz+sv3y2N1xzAZprkmuN/SD5iKefj

Score

10^/10

formbook ow persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

ow

Decoy

piavecaffe.com

jlxkqg.men

lifesavingfoundation.net

karadasama.net

michaeltraolach-macsweeney.com

thunderwatches.com

serviciocasawhirlpool.biz

c-cap.online

itparksolution.com

clarityhearingkw.com

wpgrosiri.date

colemarshalcambell.com

webperffest.com

adjusterforirma.info

buildersqq.com

spiritualwisdominindia.com

111222333.net

traditionalarabicdishes.com

hmlifi.com

receive-our-info-heredaily.info

Targets

- Target
  
  d573453967dac41998011aaaa662acf4
- Size
  
  483KB
- MD5
  
  d573453967dac41998011aaaa662acf4
- SHA1
  
  3406d434dd688db8ea050ba90143293c36cff270
- SHA256
  
  571b79715074fca09bf065bf7eefa5ae1e827da26d6241365d77ba6d337cf2b8
- SHA512
  
  febbb66d257cd864bfa0172b0b308e392a2b82dd837df14e656a2211c779e8c3beee5a401bfa585379b9a5b6f12a0758df185ab648509bb4cf8c657b4bd91fd8
- SSDEEP
  
  6144:CIFhuSYWFYgrKsUc3y2WnO1xzcWmZXe2rkwnbo60T21BOcCSrYDEgfje5ig1ef9h:Ph8Mz+sv3y2N1xzAZprkmuN/SD5iKefj
Score

10^/10

formbook ow persistence rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

formbookowpersistenceratspywarestealertrojan