formbook

General

Target

potvrdaPlacanja_229523624_NetBanking.PDF.bin
Size

650KB
Sample

240528-na5cbagf51
MD5

c2cfb3eba8906a6709e2f4da166494a9
SHA1

3fe5fa561c199d0cc4e361714fa503c0062b8b94
SHA256

86579758583cd17bc1bb28d3b4b0cfa6a6996a54595db68bd84f3e1c69fe6d30
SHA512

defa95ecfa347c5b0e258085bd01a3c2d6fd5a0bd6a4e6ba287c51cd522017da692136d5cc43fd42762165fbf7fd300d2c6b3d590ef34e7dba9e2f3bd68c18c2
SSDEEP

12288:UQDWJkhvg8m3T0o1uMehVz1mOW0KWer+Y2C6ek8AsU01/9Qx2uyjy5tRUe92OckR:eGyD0WNW1t4Wer+Y2C6QAsn1Qx27Q

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn03

Decoy

almouranipainting.com

cataloguia.shop

zaparielectric.com

whcqsc.com

ioco.in

aduredmond.com

vavada611a.fun

humtivers.com

jewellerytml.com

mcapitalparticipacoes.com

inhlcq.shop

solanamall.xyz

moviepropgroup.com

thegenesis.ltd

cyberxdefend.com

skinbykoco.com

entermintlead.com

honestaireviews.com

wyclhj7gqfustzp.buzz

w937xb.com

Targets

- Target
  
  potvrdaPlacanja_229523624_NetBanking.PDF.bin
- Size
  
  650KB
- MD5
  
  c2cfb3eba8906a6709e2f4da166494a9
- SHA1
  
  3fe5fa561c199d0cc4e361714fa503c0062b8b94
- SHA256
  
  86579758583cd17bc1bb28d3b4b0cfa6a6996a54595db68bd84f3e1c69fe6d30
- SHA512
  
  defa95ecfa347c5b0e258085bd01a3c2d6fd5a0bd6a4e6ba287c51cd522017da692136d5cc43fd42762165fbf7fd300d2c6b3d590ef34e7dba9e2f3bd68c18c2
- SSDEEP
  
  12288:UQDWJkhvg8m3T0o1uMehVz1mOW0KWer+Y2C6ek8AsU01/9Qx2uyjy5tRUe92OckR:eGyD0WNW1t4Wer+Y2C6QAsn1Qx27Q
Score

10^/10

formbook dn03 execution rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2