formbook

General

Target
PO.exe
Size 1.3MB
Sample241111-gdgl4avarb
SHA256 88795ccbb26f764aa31d3e28c8df85f970334a67bc61b06682745b185900ea75
MD5 4642ca8583e94f1d76e01db9f79185db
SHA1 1b2e96a56d4e91d2aebe9468ccc0c1e275d96a3a
SHA512 fd8f54f3f1d2667d627c81dcd4380618081fbac7cd3a9c29653cd9a5710f3c7b33de383aed47ca3138beb6090d02f50ed60d24363934f29904700ee8e318f612
SSDEEP 24576:P5EmXFtKaL4/oFe5T9yyXYfP1ijXda5nRbWfcnnAvKyS+SkAtm+:PPVt/LZeJbInQRa5RgYnvySbkA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cl21

Decoy

0001.shop
earch-parttimejobs.today
are888.top
akanhaunthipped.shop
othing-heyu.xyz
cadvirsor.net
nclanalae.shop
lectric-cars-mexico.today
oxj-question.xyz
ersonalloanoffers.today
ersonalloans-fo54-fo37.click
verybody-ewfx.xyz
ercuremontauban.media
azilimdunyam.net
airs-clinicato.today
wiftsscend.click
ertainly-jbws.xyz
8xeng.app
damekadmitageable.cfd
ollapsedec.shop
mpldo.app
g18q29a.top
etaddiction.tech
lbatasalboinamoco.shop
eyyzj-medical.xyz
ote-lmeg.xyz
cellelukacs.shop
evinedesignz11.net
n217.vip
eimy.top
ellisimaa.shop
hjk-west.xyz
nline-dating-be-10.today
wocykmw.top
ytsxv.xyz
iding-lawn-mower.today
olarpergolasolutions.today
ainco.net
r86yd.top
ndrvb-stock.xyz
ing88vn.today
vez3.xyz
fg-am.pro
ultplanlz.click
ecurebet.click
fjng-court.xyz
rsenalatamanaxweed.shop
iaoyingtao16.vip
rime-kvsff.xyz
ufdd-interesting.xyz
qbdl-base.xyz
ushihq.xyz
400108pptddbo685.top
tself-gqemlq.xyz
uyher.shop
ffprintshoplv.shop
ushyniceneobaza.cfd
dmrroa.net
ar-deals-ca-8966160.live
ramx-jorv.top
ifw-less.xyz
hwisdom.net
xrjgq-prepare.xyz
rchertravel.click
ingledatings46.xyz

Targets

- Target
  PO.exe
- Size 1.3MB
- SHA256 88795ccbb26f764aa31d3e28c8df85f970334a67bc61b06682745b185900ea75
- MD5 4642ca8583e94f1d76e01db9f79185db
- SHA1 1b2e96a56d4e91d2aebe9468ccc0c1e275d96a3a
- SHA512 fd8f54f3f1d2667d627c81dcd4380618081fbac7cd3a9c29653cd9a5710f3c7b33de383aed47ca3138beb6090d02f50ed60d24363934f29904700ee8e318f612
- SSDEEP 24576:P5EmXFtKaL4/oFe5T9yyXYfP1ijXda5nRbWfcnnAvKyS+SkAtm+:PPVt/LZeJbInQRa5RgYnvySbkA
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook cl21 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2