formbook

General

Target

c73fb599aa168248ab95c1020bfa198e3f580c6ecc926999efd6e2e63e7e2438
Size

833KB
Sample

240917-lss1wswgpm
MD5

7d149347bd224b0b8fa6fc2a21b32331
SHA1

04faf0eed0282e3b95767b0d0c7b5858dacf4640
SHA256

c73fb599aa168248ab95c1020bfa198e3f580c6ecc926999efd6e2e63e7e2438
SHA512

b7f8aa9e6a9400ba592a8e76c13e47e3d23ee8a32a379d0a019a2afd619cc4734906ea6592c7915e2540125b6f95466400cc05b0b919a349e49a780a8ee8e306
SSDEEP

24576:LzFh6Ax5KkdYBlZ0hM1NyUkZdLN350DkwhH:3Fh6MKkWp0hAtknh8H

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

c24t

Decoy

ealthbridgeccs.online

ngelicais.art

uktuksu1.sbs

fapoker.asia

hecreature.tech

orenzoplaybest14.xyz

op-smartphones-deal.today

delark.click

7395.asia

otnews.cfd

j16e.xyz

oko.events

fscxb.top

roudtxliberals.vote

asas-br.bond

ourhealthyourlife.shop

fbpd.top

j9u9.xyz

uijiuw.top

aming-chair-37588.bond

Targets

- Target
  
  TT COPY.exe
- Size
  
  1.1MB
- MD5
  
  5edb0f8e0ef6dd1e0d402f644c874e0f
- SHA1
  
  46e50727606336dbe5257ba0c9e77006b7b710e0
- SHA256
  
  5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8
- SHA512
  
  8129e3a284ed8514ed71367d03e8afd537d6636a78dce7995d2f48f32857a67a87dcdca102a45b33ab56e5e6486c45205d552b51b6907eda801def655288e6a8
- SSDEEP
  
  24576:uRmJkcoQricOIQxiZY1iaC6WzN6M6ZdLNX50DEMhc:7JZoQrbTFZY1iaC6sb6TnAc
Score

10^/10

formbook c24t discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2