formbook

General

Target

66eb19b3d2754a223f6120908f298942f85d2c26d117a744945acbc91376e8c0.exe
Size

774KB
Sample

241120-pehjsawqdv
MD5

b07ab297402809750fea6aecf8442240
SHA1

b75d17501d3e84ada97aaed5aa1dff0b5b59caf4
SHA256

66eb19b3d2754a223f6120908f298942f85d2c26d117a744945acbc91376e8c0
SHA512

edc2d110f306725984bae4c3f4815e6a3ce19c7c25ea2cef207267dcb366822a87e096aa0fff5a8cddcd5a8e6c8b59d3fc28b2cf461a32cc40fe54ab38562435
SSDEEP

24576:yU2prkC5LF9wQ8q57ZcBASdzJ0WKD2ErkG:lSgwLj5576qSdl0WKSUb

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dr14

Decoy

ypewriter.pro

conoficina.shop

etrules.net

bwuc-ball.xyz

obis.xyz

tpbuncistoto.xyz

lhakikas.net

long-ybzxgm.xyz

ray-east.xyz

hild-rbfij.xyz

imself-kyac.xyz

ftuu-government.xyz

om-tracksi.top

olicy-yzipy.xyz

ntalaxlesbabbool.cfd

ingleyou.top

ieryfiertzframing.cfd

pon-nacgrz.xyz

aomei515.top

alzgroup.net

Targets

- Target
  
  66eb19b3d2754a223f6120908f298942f85d2c26d117a744945acbc91376e8c0.exe
- Size
  
  774KB
- MD5
  
  b07ab297402809750fea6aecf8442240
- SHA1
  
  b75d17501d3e84ada97aaed5aa1dff0b5b59caf4
- SHA256
  
  66eb19b3d2754a223f6120908f298942f85d2c26d117a744945acbc91376e8c0
- SHA512
  
  edc2d110f306725984bae4c3f4815e6a3ce19c7c25ea2cef207267dcb366822a87e096aa0fff5a8cddcd5a8e6c8b59d3fc28b2cf461a32cc40fe54ab38562435
- SSDEEP
  
  24576:yU2prkC5LF9wQ8q57ZcBASdzJ0WKD2ErkG:lSgwLj5576qSdl0WKSUb
Score

10^/10

formbook dr14 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2