formbook

General

Target

dbd18e896a9fc9f3188a73431f08bb0bae2b26db47bf9c1f785c021f16c1bbe9
Size

1.0MB
Sample

241030-f9g23axepc
MD5

469ed9f643e1e098b2b9d1fda3593e20
SHA1

1ac7e98b16a5f287a62fd1c97a0f6ca176beb2eb
SHA256

dbd18e896a9fc9f3188a73431f08bb0bae2b26db47bf9c1f785c021f16c1bbe9
SHA512

619fc4d32fffe5881f4f0dfb403d5cb8e31e75b001231fe4d0ec8569069ad634e628f049296b61adf427d1b42ce02b57f87e6efe15e0a353e369ed38fdf73565
SSDEEP

12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLPuEwKaoHG8kb7ufT/xJAI96PQOntE4:ffmMv6Ckr7Mny5QLwony7s/r56P9ZZ

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fh84

Decoy

mtzyn.top

zfn-no-hsts.win

j10g.xyz

arehouse-inventory-60572.bond

nlineprodutooffer.shop

ar-deals-77764.bond

e3m2.xyz

cquisitive.group

unkusol.xyz

01307.xyz

uratedcelebrations.net

nfiniworkshop-thai.online

s-cmc.net

idney360.info

ipolar-treatment-us-311-ze.zone

entenstituleridernegi.biz

olombiaoutlet.shop

uradab.rest

qega.shop

73519.vip

Targets

- Target
  
  dbd18e896a9fc9f3188a73431f08bb0bae2b26db47bf9c1f785c021f16c1bbe9
- Size
  
  1.0MB
- MD5
  
  469ed9f643e1e098b2b9d1fda3593e20
- SHA1
  
  1ac7e98b16a5f287a62fd1c97a0f6ca176beb2eb
- SHA256
  
  dbd18e896a9fc9f3188a73431f08bb0bae2b26db47bf9c1f785c021f16c1bbe9
- SHA512
  
  619fc4d32fffe5881f4f0dfb403d5cb8e31e75b001231fe4d0ec8569069ad634e628f049296b61adf427d1b42ce02b57f87e6efe15e0a353e369ed38fdf73565
- SSDEEP
  
  12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLPuEwKaoHG8kb7ufT/xJAI96PQOntE4:ffmMv6Ckr7Mny5QLwony7s/r56P9ZZ
Score

10^/10

formbook fh84 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2