formbook

General

Target

f55312e5242f14dc500d5e8e72059b5a470afcf9dbf145a46617626874399bd0
Size

596KB
Sample

241105-qz6yjs1nht
MD5

9841794bc88dfc8df8f5d80135ebf8c9
SHA1

e2136760618dcdf5dcda269fa76558b94cc28cf0
SHA256

f55312e5242f14dc500d5e8e72059b5a470afcf9dbf145a46617626874399bd0
SHA512

ab213c1a24294cd2a2549616f6980a72a7f69c50603cf6fc1833c4430b1c5b53eb197295bc307fa8e1b3108febb426599dc145cf826af2290e48ce7fc816a438
SSDEEP

12288:PPmx4he4IPBnbxgVDtW98BaxyM5TsmhZ5sRrDUUJdtdaveg:P+x4+Zdg5di35Q+AR3drIWg

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m25s

Decoy

araghospitality.net

cleans.xyz

olnacasinotcs14.top

pringhillinfos.net

erkakasrumah.online

orean-course-289113002.zone

yeloma-treatment-82106.bond

76iw543gw.autos

nline-shopping-56055.bond

enetik.xyz

ax-th-6011838.fyi

itygatehousing.app

23zy998jk.bond

pslag-hal-2.online

uykoii.shop

9supjub3p.buzz

tmgl.bond

actus-catering-creations.net

ntercashspace24.homes

ierra777.vip

Targets

- Target
  
  Payment slip TT.exe
- Size
  
  730KB
- MD5
  
  5643e7a6dd9dcdb73826348ffc0e4a5c
- SHA1
  
  d817b6131b61597c2fe9dcfc2aec0ce2341adeb4
- SHA256
  
  794f51202f35431d4b1523aebd8f72ec72cdac3b53a297ae256010567d5aae84
- SHA512
  
  d7bec53c63465a7ae5779e96af07f54290f15afee58d9b5fa284ae564976f2f27a4a202b9306fe8bc5255502bb97818e37178712eb58b58cde95cb4b3bad48d0
- SSDEEP
  
  12288:fFgX2D0LK8uX3OAVDtWx8LaxyE5TWh2Lq/c+RK09X:9gmDAm55fAd5q2uU+RV
Score

10^/10

discovery formbook m25s rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2