formbook | 534e660f9cdcc1e76d0674657dd6b09cc2f5856e34f71369e06ccb2d58120fec | Triage

Submit
Reports

Overview

overview

Static

static

5

SHIPPING D...24.exe

windows7-x64

SHIPPING D...24.exe

windows10-2004-x64

Sharing

General

Target

SHIPPING DOC INVOICE NO.HCAB2324.exe
Size

1.0MB
Sample

241028-qa5zysxpdw
MD5

d1c637d049eb33c643b42d3b2c31c95f
SHA1

ffb84ed4e639b6654af0b0aeb9b488b6d7d6d83e
SHA256

534e660f9cdcc1e76d0674657dd6b09cc2f5856e34f71369e06ccb2d58120fec
SHA512

cf85b73c20e84a5d02a3ea6ac098413d500f8cd1d231a9ce91bf79507d9a615f59dc0a2aa7e40e0e2e6af7c489e07ecb96c39d88c27d5dfbea1e786d28a3f9c2
SSDEEP

24576:ffmMv6Ckr7Mny5QLQm4lWq4F33OpK4Zmu:f3v+7/5QLQpWd3YK4z

Score

10^/10

formbook ge07 discovery rat spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

SHIPPING DOC INVOICE NO.HCAB2324.exe

Resource

win7-20240903-en

formbook ge07 discovery rat spyware stealer trojan

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

SHIPPING DOC INVOICE NO.HCAB2324.exe

Resource

win10v2004-20241007-en

formbook ge07 discovery rat spyware stealer trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ge07

Decoy

amyard.shop

eloshost.xyz

g18q11a.top

orensic-vendor-735524320.click

ithin-ksvodn.xyz

xhyx.top

elonix-traceglow.pro

cillascrewedsedroth.cfd

wner-nyquh.xyz

reyhazeusa.shop

esmellretaperetotal.cfd

hqm-during.xyz

pipagtxcorrelo.xyz

lray-civil.xyz

apybarameme.xyz

rbuds.shop

hild-fcudh.xyz

rkgexg.top

estwestcottwines.shop

giyztm.xyz

epehr.pics

lways-vhyrp.xyz

acifictechnologycctv.net

iscinddocenaemlynne.cfd

ridesmaidgiftsboutiqueki.shop

ubtleclothingco.fashion

hemicans.xyz

ebaoge318.top

zoc-marriage.xyz

ngeribe2.homes

oal-ahzgwo.xyz

eries-htii.xyz

ool-covers76.xyz

ecurityemployment.today

croom.net

f7y2i9fgm.xyz

earch-lawyer-consultation.today

066iwx2t.shop

ound-omagf.xyz

ivglass.xyz

fdyh-investment.xyz

yegle.net

eader-aaexvn.xyz

dvle-father.xyz

onsfskfsmpfssfpewqdsawqe.xyz

ffect-xedzl.xyz

ood-packaging-jobs-brasil.today

lasterdeals.shop

ehkd.top

pm-22-ns-2.click

ocockbowerlybrawer.cfd

ostcanadantpl.top

vrkof-point.xyz

lsader.app

nce-ystyx.xyz

azl.pro

ea-yogkkb.xyz

isit-txax.xyz

rowadservepros.net

6282.xyz

roduct-xgky.xyz

wner-nyquh.xyz

sfmoreservicesllc.lat

rasko.net

9net88.net

Targets

- Target
  
  SHIPPING DOC INVOICE NO.HCAB2324.exe
- Size
  
  1.0MB
- MD5
  
  d1c637d049eb33c643b42d3b2c31c95f
- SHA1
  
  ffb84ed4e639b6654af0b0aeb9b488b6d7d6d83e
- SHA256
  
  534e660f9cdcc1e76d0674657dd6b09cc2f5856e34f71369e06ccb2d58120fec
- SHA512
  
  cf85b73c20e84a5d02a3ea6ac098413d500f8cd1d231a9ce91bf79507d9a615f59dc0a2aa7e40e0e2e6af7c489e07ecb96c39d88c27d5dfbea1e786d28a3f9c2
- SSDEEP
  
  24576:ffmMv6Ckr7Mny5QLQm4lWq4F33OpK4Zmu:f3v+7/5QLQpWd3YK4z
Score

10^/10

formbook ge07 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

formbookge07discoveryratspywarestealertrojan

behavioral2

formbookge07discoveryratspywarestealertrojan

© 2018-2024

Terms | Privacy