formbook

General

Target
MalwareBazaar.11
Size 918KB
Sample240801-tkc9gashke
SHA256 2aa8ec244fd85957972c5dc5e2d05f8485e7b4becd16d68e4e0dfe5594ce7272
MD5 2d9132f8cb67c74e17b5c9a97d97d98b
SHA1 e20c86b162d7a612b9b5b741c65bdd98261c86ef
SHA512 16193ecf9a1856e3b9b806037078f002ed7323ce90497cd0ed40c4194e6f0f69d4c956c32433da4412ea725d2c30b6248e618d988be63af40a98b552f2915ffd
SSDEEP 12288:r0mTFhv5VQZ9WsgF91raePmsr55MGBoIaETRavD7R5GsYG2ucIBIjuei:r0m/x4xgF9hmDGdGSGVLff
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

na10

Decoy

tetheus.com
ventlikeyoumeanit.com
tintbliss.com
rinabet357.com
sapphireboutiqueusa.com
abc8bet6.com
xzcn3i7jb13cqei.buzz
pinktravelsnagpur.com
bt365038.com
rtpbossujang303.shop
osthirmaker.com
thelonelyteacup.com
rlc2019.com
couverture-charpente.com
productivagc.com
defendercarcare.com
abcentixdigital.com
petco.ltd
oypivh.top
micro.guru
hokivegasslots.club
5663876.com
symboleffekt.info
tworiverlabsintake.com
pegaso.store
sasoera.com
material.chat
taniamckirdy.com
dansistosproductions.com
moromorojp.com
z27e1thx976ez3u.buzz
skinrenue.com
nbvci.xyz
jakobniinja.xyz
snykee.com
sl24.top
wawturkiye.xyz
virtualeventsbyelaine.com
giorgiaclerico.com
d9psk8.xyz
hard-to-miss.space
awclog.com
topcomparativos.com
somoyboutique.com
findlove.pro
zbo170.app
dexcoenergy.com
nona23.lat
ingelset.com
hexatelier.com
nftees.tech
visionarymaterialsinstitute.com
khanyos.com
bz59.top
migraine-treatment-28778.bond
catboxbot.online
kkugames.com
llmsearchoptimization.com
fipbhvvb.xyz
vmytzptc.xyz
intermediafx.shop
lhrrs.com
grimreapervalley.com
discount-fess.space
liamcollinai.com

Targets

- Target
  MalwareBazaar.11
- Size 918KB
- SHA256 2aa8ec244fd85957972c5dc5e2d05f8485e7b4becd16d68e4e0dfe5594ce7272
- MD5 2d9132f8cb67c74e17b5c9a97d97d98b
- SHA1 e20c86b162d7a612b9b5b741c65bdd98261c86ef
- SHA512 16193ecf9a1856e3b9b806037078f002ed7323ce90497cd0ed40c4194e6f0f69d4c956c32433da4412ea725d2c30b6248e618d988be63af40a98b552f2915ffd
- SSDEEP 12288:r0mTFhv5VQZ9WsgF91raePmsr55MGBoIaETRavD7R5GsYG2ucIBIjuei:r0m/x4xgF9hmDGdGSGVLff
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook na10 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Deletes itself

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2