formbook

General

Target

14102024_1416_14102024_ENQ-2024e-HRZ.zip
Size

585KB
Sample

241014-rk73qsygqg
MD5

d55706dd3ef117e0804588349d82417d
SHA1

8c823030e6eb5f2d69c99e382ca60a7882ffcce0
SHA256

4368806ba12c0e5db66dd6401af73d1d29bd94647711dda5a14b1c05451d2b56
SHA512

d0a051ea2a8120ab5e18086facf77fd2e24e59b63481cb692357fce0257acd5880a1c5bb20914ba79ded5b934a70041d48301b3fd45fcb5112b7e360a28b3bf0
SSDEEP

12288:mUUMt8o2bhwRNZUR/6WDEDaY2+vfy0aWTRF6ZGGmfLi+8E+m:uMSo2dANZ6FEGWv65WTaZGxfO+X

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

c24t

Decoy

ealthbridgeccs.online

ngelicais.art

uktuksu1.sbs

fapoker.asia

hecreature.tech

orenzoplaybest14.xyz

op-smartphones-deal.today

delark.click

7395.asia

otnews.cfd

j16e.xyz

oko.events

fscxb.top

roudtxliberals.vote

asas-br.bond

ourhealthyourlife.shop

fbpd.top

j9u9.xyz

uijiuw.top

aming-chair-37588.bond

Targets

- Target
  
  ENQ-2024e-HRZ.exe
- Size
  
  677KB
- MD5
  
  75aacca487fb7128f42de15494552fac
- SHA1
  
  96772c827aa2761f3c24d8d43b772e540bf018d2
- SHA256
  
  5d021ca8e798f9713c4778b806fa00c207dbe34f4efec22ec5d1b65dd59c68a7
- SHA512
  
  a3422ce50e83f9f3a229604a1748db6e8c332de2c2cfa3ce68ab7790f82310397ee574783e35620dc46813572b99c661a718e053b66d2fb1aa5587027b295a1f
- SSDEEP
  
  12288:eL3exHZno/a5VhER7UZ5ahB028cuoxjjCrST6KRNtuSnRLCEEguWqpn:eL3exH9o4Xs4Z5ahB58cuoxjWmJRGSnO
Score

10^/10

formbook c24t discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Blocklisted process makes network request
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Blocklisted process makes network request

Deletes itself

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2