formbook

General

Target

07888aca315d288cf934104bbee91f5a2d6cec258f9e8052adfb496cc7ea1f16
Size

739KB
Sample

241116-rsz24asjgp
MD5

324a001765714ace68f36be3dbba911b
SHA1

97d0663bbe94c1b48385cbcb99f5edb13b44191a
SHA256

07888aca315d288cf934104bbee91f5a2d6cec258f9e8052adfb496cc7ea1f16
SHA512

fb8a462887ef68009a1d2c1128df2122d2dbfb8c2e95dd197922a46e615ef7951be98b85522d9507078e83d46f4b16bec1fc331cede369df79845c2e6d2fce62
SSDEEP

12288:WgWVfEys3/9TwDdteNle31LI18mTeHluHDv2Cel/iWGEvkiDEmbGq:HWVfEn1To4C1s5eHlovBo/iWGEcnmN

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

md49

Decoy

enithpro.shop

utozeed.agency

ornpicsbd.xyz

82yjj301.top

kphone.online

3ccha73hdl5.shop

seinow.online

usurrofest.info

2ads2s2.top

oritskul.net

etlivecasino.bet

erts.navy

anieubezpieczenia.online

dyhph1020pm.top

paceglide.space

ibmedia.net

arwyking.icu

soriaticarthritis101.today

earopia.shop

gctg2qt4h.top

Targets

- Target
  
  07888aca315d288cf934104bbee91f5a2d6cec258f9e8052adfb496cc7ea1f16
- Size
  
  739KB
- MD5
  
  324a001765714ace68f36be3dbba911b
- SHA1
  
  97d0663bbe94c1b48385cbcb99f5edb13b44191a
- SHA256
  
  07888aca315d288cf934104bbee91f5a2d6cec258f9e8052adfb496cc7ea1f16
- SHA512
  
  fb8a462887ef68009a1d2c1128df2122d2dbfb8c2e95dd197922a46e615ef7951be98b85522d9507078e83d46f4b16bec1fc331cede369df79845c2e6d2fce62
- SSDEEP
  
  12288:WgWVfEys3/9TwDdteNle31LI18mTeHluHDv2Cel/iWGEvkiDEmbGq:HWVfEn1To4C1s5eHlovBo/iWGEcnmN
Score

10^/10

formbook md49 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2