formbook

General

Target

New order number 240611-06SN.exe
Size

564KB
Sample

241025-rmvkes1bqb
MD5

2f3877d0041db22af7371e723df92208
SHA1

14453b14d3022d25e8a77b3d07ed86c262f605e3
SHA256

f5192d0f7603e198e0b3098e9204ab40d11958a9bc27d8477db41cd5350b6242
SHA512

8f03afed1eb4241a8be0659f99ef03d2a6bf24f374a8aefb97fa1b74b3b23746ba2da95f979d9602515e5337ec3f107c634cff89990dc58fdceb6a3485ff08e1
SSDEEP

12288:L1RveBYTDV7JYrVM35ZtPwEBemDdQCKMgW/fHjuAxzP1b7cDoh9mKx:L1RWBY9JY5M35TPBemDRN/z9qohx

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fh84

Decoy

mtzyn.top

zfn-no-hsts.win

j10g.xyz

arehouse-inventory-60572.bond

nlineprodutooffer.shop

ar-deals-77764.bond

e3m2.xyz

cquisitive.group

unkusol.xyz

01307.xyz

uratedcelebrations.net

nfiniworkshop-thai.online

s-cmc.net

idney360.info

ipolar-treatment-us-311-ze.zone

entenstituleridernegi.biz

olombiaoutlet.shop

uradab.rest

qega.shop

73519.vip

Targets

- Target
  
  New order number 240611-06SN.exe
- Size
  
  564KB
- MD5
  
  2f3877d0041db22af7371e723df92208
- SHA1
  
  14453b14d3022d25e8a77b3d07ed86c262f605e3
- SHA256
  
  f5192d0f7603e198e0b3098e9204ab40d11958a9bc27d8477db41cd5350b6242
- SHA512
  
  8f03afed1eb4241a8be0659f99ef03d2a6bf24f374a8aefb97fa1b74b3b23746ba2da95f979d9602515e5337ec3f107c634cff89990dc58fdceb6a3485ff08e1
- SSDEEP
  
  12288:L1RveBYTDV7JYrVM35ZtPwEBemDdQCKMgW/fHjuAxzP1b7cDoh9mKx:L1RWBY9JY5M35TPBemDRN/z9qohx
Score

10^/10

formbook fh84 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2