formbook

General

Target

SALESORDER875.exe
Size

1.3MB
Sample

241101-qgwd4ayrew
MD5

6ac24df0d8b58005679910e42981dbe8
SHA1

e421e5241a965e8714d3506dfb0aabc06ee52603
SHA256

eb00047a6b0c3483760d36fc53b69398768f28532003f44d0b402052f65bbd24
SHA512

6181b4ef3b6850c3fb60bfab6637e0fe80fd13fd14e2c56c8fd4cb25f633950d5c38262566ec3a77563a0aa17c4e5ffee78fe6962992175a5938a275c5488259
SSDEEP

24576:MqDEvCTbMWu7rQYlBQcBiT6rprG8a8tqTr5mBln/sKG4K5nwqsPGAAJBl7:MTvC/MTQYxsWR7a8tqhmDn64K5sAV

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ge07

Decoy

amyard.shop

eloshost.xyz

g18q11a.top

orensic-vendor-735524320.click

ithin-ksvodn.xyz

xhyx.top

elonix-traceglow.pro

cillascrewedsedroth.cfd

wner-nyquh.xyz

reyhazeusa.shop

esmellretaperetotal.cfd

hqm-during.xyz

pipagtxcorrelo.xyz

lray-civil.xyz

apybarameme.xyz

rbuds.shop

hild-fcudh.xyz

rkgexg.top

estwestcottwines.shop

giyztm.xyz

Targets

- Target
  
  SALESORDER875.exe
- Size
  
  1.3MB
- MD5
  
  6ac24df0d8b58005679910e42981dbe8
- SHA1
  
  e421e5241a965e8714d3506dfb0aabc06ee52603
- SHA256
  
  eb00047a6b0c3483760d36fc53b69398768f28532003f44d0b402052f65bbd24
- SHA512
  
  6181b4ef3b6850c3fb60bfab6637e0fe80fd13fd14e2c56c8fd4cb25f633950d5c38262566ec3a77563a0aa17c4e5ffee78fe6962992175a5938a275c5488259
- SSDEEP
  
  24576:MqDEvCTbMWu7rQYlBQcBiT6rprG8a8tqTr5mBln/sKG4K5nwqsPGAAJBl7:MTvC/MTQYxsWR7a8tqhmDn64K5sAV
Score

10^/10

formbook ge07 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2