formbook

General

Target

cefb9fa4e30ee9fadb577302fb861fd10e7fcfc440e3de1b7dcf7a0c9b3dbc2a
Size

586KB
Sample

241117-slhpxa1rgz
MD5

89a3a3fafda831624080b6e276025780
SHA1

380ee035bb520092f253bce1f16143dbaa2c4df8
SHA256

cefb9fa4e30ee9fadb577302fb861fd10e7fcfc440e3de1b7dcf7a0c9b3dbc2a
SHA512

0ad3910b5daa89e082a43e7e8bc4c7698cc3f562fa305585da0c34e4e1525b40d926d216114b8f8d625687097b40f9e9d8298fa3e5bb9ce89ca2e765bfac80c7
SSDEEP

12288:/+0nsDHy9+itpSpCl0GyaSACNMPY6aNlaMUfXAKSLD:/xnF/T6U0sSXNMwdyMUCn

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dr14

Decoy

ypewriter.pro

conoficina.shop

etrules.net

bwuc-ball.xyz

obis.xyz

tpbuncistoto.xyz

lhakikas.net

long-ybzxgm.xyz

ray-east.xyz

hild-rbfij.xyz

imself-kyac.xyz

ftuu-government.xyz

om-tracksi.top

olicy-yzipy.xyz

ntalaxlesbabbool.cfd

ingleyou.top

ieryfiertzframing.cfd

pon-nacgrz.xyz

aomei515.top

alzgroup.net

Targets

- Target
  
  cefb9fa4e30ee9fadb577302fb861fd10e7fcfc440e3de1b7dcf7a0c9b3dbc2a
- Size
  
  586KB
- MD5
  
  89a3a3fafda831624080b6e276025780
- SHA1
  
  380ee035bb520092f253bce1f16143dbaa2c4df8
- SHA256
  
  cefb9fa4e30ee9fadb577302fb861fd10e7fcfc440e3de1b7dcf7a0c9b3dbc2a
- SHA512
  
  0ad3910b5daa89e082a43e7e8bc4c7698cc3f562fa305585da0c34e4e1525b40d926d216114b8f8d625687097b40f9e9d8298fa3e5bb9ce89ca2e765bfac80c7
- SSDEEP
  
  12288:/+0nsDHy9+itpSpCl0GyaSACNMPY6aNlaMUfXAKSLD:/xnF/T6U0sSXNMwdyMUCn
Score

10^/10

formbook dr14 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2