formbook

General

Target

PRE ALERT 160-483389647002.exe
Size

1.0MB
Sample

241004-kwlkjszana
MD5

7d3690538c648f6f0e5c0403deab233f
SHA1

35e06729a4982ef682a8f2b6b57b37adc1b7a376
SHA256

36c2e9d3423587948ebc93899463684eb7de6a26a62f4e560211812253c72819
SHA512

31585756e06c37139d188a96fa0b272e4a027c057ce9a55a592d852b8cfba809dfcc13c936dca595fce2a2d162c203f58a3b427a6616aec1f34a7faf032a95b1
SSDEEP

12288:ULkcoxg7v3qnC11ErwIhh0F4qwUgUny5QNroF4LELQ8UUEvdpeOmL0pBnLvG:KfmMv6Ckr7Mny5Qtn2punPg0pB7G

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e62s

Decoy

ellinksa.shop

uckyspinph.xyz

owdark.net

arriage-therapy-72241.bond

w7ijko4rv4p97b.top

heirbuzzwords.buzz

aspart.shop

ctivemail5-kagoya-com.info

shacertification9.shop

zitcd65k3.buzz

llkosoi.info

ru8.info

rhgtrdjdjykyetrdjftd.buzz

yschoollist.kiwi

oftfolio.online

rograma-de-almacen-2.online

oudoarms.top

mwquas.xyz

orjagaucha.website

nlinechat-mh.online

Targets

- Target
  
  PRE ALERT 160-483389647002.exe
- Size
  
  1.0MB
- MD5
  
  7d3690538c648f6f0e5c0403deab233f
- SHA1
  
  35e06729a4982ef682a8f2b6b57b37adc1b7a376
- SHA256
  
  36c2e9d3423587948ebc93899463684eb7de6a26a62f4e560211812253c72819
- SHA512
  
  31585756e06c37139d188a96fa0b272e4a027c057ce9a55a592d852b8cfba809dfcc13c936dca595fce2a2d162c203f58a3b427a6616aec1f34a7faf032a95b1
- SSDEEP
  
  12288:ULkcoxg7v3qnC11ErwIhh0F4qwUgUny5QNroF4LELQ8UUEvdpeOmL0pBnLvG:KfmMv6Ckr7Mny5Qtn2punPg0pB7G
Score

10^/10

formbook e62s discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.