formbook

General

Target

Court Transfer of Rights.exe
Size

1.3MB
Sample

241111-qp3s5szfmc
MD5

d4872c2f92a2b2669cb7e55c1714495a
SHA1

d74acf1b04946ffa18d542e985a6780d748a9a8d
SHA256

90f0b142274a5613c660dd9cf60dba79bf5abec4e20734122ca0b2f5b9e7a904
SHA512

5811aa717808fa4f56475a7e081dbfd78a0065992a60ab1f787e5abc5672fffdf2127fedb06fb008cff52e8ffdc46292412dc833befb01a3a3811d8061ffb2a6
SSDEEP

24576:C5EmXFtKaL4/oFe5T9yyXYfP1ijXdaEcbg/4ieadFVSXNIF/bzCXvXGrD4o:CPVt/LZeJbInQRaEcbgAirTVSXNcbGGf

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cl21

Decoy

0001.shop

earch-parttimejobs.today

are888.top

akanhaunthipped.shop

othing-heyu.xyz

cadvirsor.net

nclanalae.shop

lectric-cars-mexico.today

oxj-question.xyz

ersonalloanoffers.today

ersonalloans-fo54-fo37.click

verybody-ewfx.xyz

ercuremontauban.media

azilimdunyam.net

airs-clinicato.today

wiftsscend.click

ertainly-jbws.xyz

8xeng.app

damekadmitageable.cfd

ollapsedec.shop

Targets

- Target
  
  Court Transfer of Rights.exe
- Size
  
  1.3MB
- MD5
  
  d4872c2f92a2b2669cb7e55c1714495a
- SHA1
  
  d74acf1b04946ffa18d542e985a6780d748a9a8d
- SHA256
  
  90f0b142274a5613c660dd9cf60dba79bf5abec4e20734122ca0b2f5b9e7a904
- SHA512
  
  5811aa717808fa4f56475a7e081dbfd78a0065992a60ab1f787e5abc5672fffdf2127fedb06fb008cff52e8ffdc46292412dc833befb01a3a3811d8061ffb2a6
- SSDEEP
  
  24576:C5EmXFtKaL4/oFe5T9yyXYfP1ijXdaEcbg/4ieadFVSXNIF/bzCXvXGrD4o:CPVt/LZeJbInQRaEcbgAirTVSXNcbGGf
Score

10^/10

formbook cl21 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2