formbook

General

Target

721254523cb93e9b54bdb99f30c1498e59248f647c147e135849782b5e985141
Size

768KB
Sample

241018-qc46fa1ckp
MD5

da8c0e113c24610b300afc44969324a0
SHA1

626d41b08a7f8ca744a98742f2b1dba8b7ce6e7c
SHA256

721254523cb93e9b54bdb99f30c1498e59248f647c147e135849782b5e985141
SHA512

7aaa780734a6abaceb70d99352b965eb20f7dd73d85007a0a6284abd2eb34480ca2034be770882639dd92f7a72fa2a5a5599a76947c860136bc407c49ad04af2
SSDEEP

12288:1gUt62HVEkfK9rRF8BW5+PaBM9HRlKEpFoqsxycdSlOhZykiVGhsb121r5W+Gw2w:1rjfYFcMvM9PJFcyoSYphc12JGw2PI

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ge07

Decoy

amyard.shop

eloshost.xyz

g18q11a.top

orensic-vendor-735524320.click

ithin-ksvodn.xyz

xhyx.top

elonix-traceglow.pro

cillascrewedsedroth.cfd

wner-nyquh.xyz

reyhazeusa.shop

esmellretaperetotal.cfd

hqm-during.xyz

pipagtxcorrelo.xyz

lray-civil.xyz

apybarameme.xyz

rbuds.shop

hild-fcudh.xyz

rkgexg.top

estwestcottwines.shop

giyztm.xyz

Targets

- Target
  
  PROFOMA INVOICE#9868 SWIFT COPY.exe
- Size
  
  1.0MB
- MD5
  
  f7094bac1985b132d7062fde67782ca3
- SHA1
  
  4049b6aff926cf94d72d70dc2f31077b88c2acde
- SHA256
  
  bf21b3d5e3aff72227f3dd2939738b9fcb7548044cc3c802f53068186016c240
- SHA512
  
  c518541099365ef59e84ce4b50e8be67525096a8bb5e1c7d8bdcc48b1dd212f2b6d8ce38b11ad0ecee3835badf290c40345e7c274486a5c294af7b9ade67d8d0
- SSDEEP
  
  24576:ffmMv6Ckr7Mny5QL+pbKmocYRhQT2lGw2zh:f3v+7/5QL+gNRGSG1
Score

10^/10

formbook ge07 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2