formbook

General

Target

r8ykXfy52F9CXd5d.exe
Size

759KB
Sample

240911-y3emga1fjb
MD5

6341110aa0627431093ef3c502f65669
SHA1

12dd6b363e9d841bce3fd0c007b1e84796909149
SHA256

761930655c92d23751075c7399bc4d384270fdeab881a8c486de0362a976b4d0
SHA512

2aee95c0f40f86f6c505cabeb2797aab5e587b3021c40156c2f5bff0ebc5d6787c5975a1978a4747a303e7cdba637498bac923a7e633931dd79b62feffaa8224
SSDEEP

12288:IQ11UoIG5MPUNDguQL6/Vt+uIMtBLn6TnfymJVDgP5BhMW+:lUobySgu26t/IMt16OmJidMW+

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he2a

Decoy

070001606.xyz

jesuseascriancas.online

as-eltransport.xyz

bankditalia-company.online

linkedin-stijngraat.online

sportsbetd.xyz

spanish-classes-76893.bond

infonation.pro

nxwzbze.forum

rush-pay.biz

fulfillmissions.lat

infolungcancer.xyz

aqario.xyz

omepro.solar

jackmanmueshl.shop

amcart.store

ishanaudichya.xyz

sun4rk.shop

depression-test-74287.bond

chipit.shop

Targets

- Target
  
  r8ykXfy52F9CXd5d.exe
- Size
  
  759KB
- MD5
  
  6341110aa0627431093ef3c502f65669
- SHA1
  
  12dd6b363e9d841bce3fd0c007b1e84796909149
- SHA256
  
  761930655c92d23751075c7399bc4d384270fdeab881a8c486de0362a976b4d0
- SHA512
  
  2aee95c0f40f86f6c505cabeb2797aab5e587b3021c40156c2f5bff0ebc5d6787c5975a1978a4747a303e7cdba637498bac923a7e633931dd79b62feffaa8224
- SSDEEP
  
  12288:IQ11UoIG5MPUNDguQL6/Vt+uIMtBLn6TnfymJVDgP5BhMW+:lUobySgu26t/IMt16OmJidMW+
Score

10^/10

formbook he2a discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Deletes itself

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2