formbook

General

Target

3f462db58c5431a7b4cc8c30fc6f9f7e17ae259da22c9db7d81b545f7cebada4
Size

832KB
Sample

240918-e3jrmssfne
MD5

fa9dc96c86f5c1eeecf489626a93af41
SHA1

14521fe79da4d9048ea90308f30891a3c4b283c3
SHA256

3f462db58c5431a7b4cc8c30fc6f9f7e17ae259da22c9db7d81b545f7cebada4
SHA512

038839b0e8b0d706db9001852d80b80561f83c25820a66c151a3df878838116dc338700d1bf8c1dd41d13568d84f448f518b65109e7eb9aa83db3fb8910cb093
SSDEEP

12288:hCzh0xGOFaOU6ACa5rXOLgoeB2BlLcY5pcz8yrFxY5joqwlMNBzU4CbLHE9C:kzFh6Ax5KkdYBlAY5yzdSjoqwlMTGuC

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

c24t

Decoy

ealthbridgeccs.online

ngelicais.art

uktuksu1.sbs

fapoker.asia

hecreature.tech

orenzoplaybest14.xyz

op-smartphones-deal.today

delark.click

7395.asia

otnews.cfd

j16e.xyz

oko.events

fscxb.top

roudtxliberals.vote

asas-br.bond

ourhealthyourlife.shop

fbpd.top

j9u9.xyz

uijiuw.top

aming-chair-37588.bond

Targets

- Target
  
  PO.exe
- Size
  
  1.1MB
- MD5
  
  77a9deeaccfa74b131ed760e8afd6bc6
- SHA1
  
  5e1a90008e1c40d8aa892b116476f39338b3b20d
- SHA256
  
  4ceecda6e1ddcf38828df1e7ea882fdfae4359ed0c6a55c86cf875dd3143b549
- SHA512
  
  5bb993cc88a71922c7a744d546864cc5d3ae1ccbf47ba4d2c5e47c573fc35f741af77da262b95f6484f2574f9b78bf4ebbec60a5c87b05bf3f017cf42f0d5e8b
- SSDEEP
  
  24576:uRmJkcoQricOIQxiZY1iaCz/DejIKALMVog+:7JZoQrbTFZY1iaCHjAS
Score

10^/10

formbook c24t discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2