formbook

General

Target

10092024_0114_09092024_ORDEN_09.09.2024 DON LAFFAN.pdf.uue
Size

611KB
Sample

240910-blq8ls1fqe
MD5

7ba41c95253e4b683f50b3dbe4f25ad5
SHA1

5a144342d6a871dbf67390726cee42b213eb4be9
SHA256

42c7add430298817e1039472135b8c107b8ab9f9a4df4e62067ab6995031d5ab
SHA512

fa15e483b6b45efc89408fd02af32730c5f0f76a94398262ed31a8cf210bcd3084ebc833a53be37cb3ef60ba97f19a9266e7de345264d76b5b51e4a9f4f3beeb
SSDEEP

12288:7tFf75+9V0l1CuxqqBUDSd6GAvizx5nL9G3eMKQN/8b3nQkreBPi9:Zq9uUoP6fvizxpL9GOMKQR80BPi9

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rn94

Decoy

st68v.xyz

conciergenotary.net

qwechaotk.top

rtpdonatoto29.xyz

8ad.xyz

powermove.top

cameras-30514.bond

vanguardcoffee.shop

umoe53fxc1bsujv.buzz

consultoriamax.net

hplxx.com

ndu.wtf

yzh478c.xyz

bigbrown999.site

xiake07.asia

resdai.xyz

the35678.shop

ba6rf.rest

ceo688.com

phimxhot.xyz

Targets

- Target
  
  ORDEN_09.09.2024 DON LAFFAN.pdf.exe
- Size
  
  1.1MB
- MD5
  
  ab773f71e8ca97d60d23a47027922fe5
- SHA1
  
  65aa81122d5d9602bb1f4c9eea7680f9c9a283f8
- SHA256
  
  1de36d2ec37c6f00f7f19fe8910db121771792e106d372212fbf82a1054d467f
- SHA512
  
  b1432335d385e4ae43631a58efca12dae884b2c299c4dc0e80255e7bcc07617c26de59d753352b3962d2d8f8380695a1f16138c5c1d816e98c495bd7eef8ab2e
- SSDEEP
  
  24576:14lavt0LkLL9IMixoEgeaybiJw6hsH3Lkq9MmCS:Mkwkn9IMHeay2JrWIaPCS
Score

10^/10

formbook rn94 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2