formbook

General

Target

7aec0c4095d53783fffee307d61a88c48ef24127f7d6a02a10dab486f6d98338
Size

561KB
Sample

241015-jep1zaweqr
MD5

ef50d7833aad8ccfc04acffa62d2d00f
SHA1

c7a833d4b8b0556e5134b76c1f996d89aa1e6b25
SHA256

7aec0c4095d53783fffee307d61a88c48ef24127f7d6a02a10dab486f6d98338
SHA512

e77a13630881566a05bcede78f8d2fe1bb0002cbd3deab3bee9b468b05b7f297b3d967139760447ac7a84965b33d08d616ffb0d0d692687646ea21417cb12d5c
SSDEEP

12288:ts20GZ+DqlZVsWZVTysJ23M+8RYAEQipjH6H2cvXb/0VZp:pVMAsWTysk7826b/cf

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn13

Decoy

5q53s.top

f9813.top

ysticsmoke.net

ignorysingeysquints.cfd

yncsignature.live

svp-their.xyz

outya.xyz

wlkflwef3sf2wf.top

etterjugfetkaril.cfd

p9eh2s99b5.top

400108iqlnnqi219.top

ynsu-condition.xyz

ndividual-bfiaen.xyz

anceibizamagazine.net

itrussips.live

orkcubefood.xyz

lindsandfurnishings.shop

ajwmid.top

pigramescentfeatous.shop

mbvcv56789.click

Targets

- Target
  
  test.exe
- Size
  
  585KB
- MD5
  
  256082a7c53b5ee01a25fc5888fbe757
- SHA1
  
  4a85dc392c02fa1e62ab8729e3967531233e5f53
- SHA256
  
  b37b37330f9c4970ca450212d0e3e902fb44110b4570bb07574621354509d045
- SHA512
  
  572e36abeb6e2b34d3a67889724ed901c640137b95425d3573376ce6d8be4026d8c64fef28b8d4548d0337528f46ff0ca2b967612f1d687e13597e0da7f58b3a
- SSDEEP
  
  12288:w8USn/BfGWFKAwszRbZEXdt6Q3zLeoZETGPENjq8S2YloHFQrqkOI/hyO:wS5fGY7z/ezLnZEyPUjnIlofm1
Score

10^/10

formbook dn13 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Deletes itself
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Deletes itself

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2