formbook

General

Target

06092024_1427_05092024_pnsUbqDripxoVlN.rar
Size

641KB
Sample

240906-rsd5masaqf
MD5

2f9dedbfa16cba41d91cfd59bb1b6c8e
SHA1

db54e95698655b524a783199f92e0fa1de70bb1e
SHA256

ea4381c4bc50798da2e24ccffcf3319a17ce203f5994213db822739f99af3f48
SHA512

1c196324ad1840243d67e078cf557db8df33c0221b4889738d99928a230df61131a6fdb91333924f08c92dea1b46b289f370f0d502c45b383708b360c9e08924
SSDEEP

12288:yw+SavZl5t1BEQz8316Nr1Aku6XckvCRodCTpNH+pKBHdhX7pmg+lNsOqDxH5JH:NGvZqD1Cr1AT6sKCoKjHDXdd+IRDV5N

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he2a

Decoy

070001606.xyz

jesuseascriancas.online

as-eltransport.xyz

bankditalia-company.online

linkedin-stijngraat.online

sportsbetd.xyz

spanish-classes-76893.bond

infonation.pro

nxwzbze.forum

rush-pay.biz

fulfillmissions.lat

infolungcancer.xyz

aqario.xyz

omepro.solar

jackmanmueshl.shop

amcart.store

ishanaudichya.xyz

sun4rk.shop

depression-test-74287.bond

chipit.shop

Targets

- Target
  
  pnsUbqDripxoVlN.exe
- Size
  
  797KB
- MD5
  
  97e3913321c6c33986767e8a6dc66713
- SHA1
  
  df2255159b5dec9c7021d6964c196701dc3b2c1f
- SHA256
  
  f18e58c9f46b724fd6f2f46eea8a1159f13123127eb0023e3fdbbc95a2b065c7
- SHA512
  
  39b690e69109574c481c736ccab4eb51b3912a5ab50e38484c3304d284617d851fd98d4cb3719732f97978346b341f3cbec9c28053b3f7fad08ecb1d1b73a62b
- SSDEEP
  
  12288:adLznrKbVt1SYgTctBde1hTC/A2Yo7FUTWFFGw4DcMI5VUQYZxkJN:adfnWbVqbctBdA5k0JT3w4lY9nJ
Score

10^/10

formbook he2a discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2