formbook

General

Target

00e3e22de6d54bc111bb8b40be73cedf0f8101e057496b2ce4409c1f9e9e9241.exe
Size

603KB
Sample

241119-veyhwsyhkr
MD5

d5f4f2d1541289d47aee976172f7e0c4
SHA1

eb3f6f55af00d49c3fb63882647e90eff07cad83
SHA256

00e3e22de6d54bc111bb8b40be73cedf0f8101e057496b2ce4409c1f9e9e9241
SHA512

cc2ae5650e52e3d82cb03275bbbd689f98436f400339292ac3eec10b8b6129e81a41c3dc5cf8379ea129841b3fde3e5eb6518ec5f391369cab3f090f870d9684
SSDEEP

12288:EMyCOazSlBBvVdPEc+dhlT9CLlb2GS8HwPL3qkEqtUf:EMyielDvHbwTQt2ZZDIqtUf

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dr14

Decoy

ypewriter.pro

conoficina.shop

etrules.net

bwuc-ball.xyz

obis.xyz

tpbuncistoto.xyz

lhakikas.net

long-ybzxgm.xyz

ray-east.xyz

hild-rbfij.xyz

imself-kyac.xyz

ftuu-government.xyz

om-tracksi.top

olicy-yzipy.xyz

ntalaxlesbabbool.cfd

ingleyou.top

ieryfiertzframing.cfd

pon-nacgrz.xyz

aomei515.top

alzgroup.net

Targets

- Target
  
  00e3e22de6d54bc111bb8b40be73cedf0f8101e057496b2ce4409c1f9e9e9241.exe
- Size
  
  603KB
- MD5
  
  d5f4f2d1541289d47aee976172f7e0c4
- SHA1
  
  eb3f6f55af00d49c3fb63882647e90eff07cad83
- SHA256
  
  00e3e22de6d54bc111bb8b40be73cedf0f8101e057496b2ce4409c1f9e9e9241
- SHA512
  
  cc2ae5650e52e3d82cb03275bbbd689f98436f400339292ac3eec10b8b6129e81a41c3dc5cf8379ea129841b3fde3e5eb6518ec5f391369cab3f090f870d9684
- SSDEEP
  
  12288:EMyCOazSlBBvVdPEc+dhlT9CLlb2GS8HwPL3qkEqtUf:EMyielDvHbwTQt2ZZDIqtUf
Score

10^/10

formbook dr14 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2