formbook

General

Target

29da4b3ce357e683598f545fb5ffd73c198d1a6084642010b4072125cc72cb86.exe
Size

482KB
Sample

241123-zgx3csvqcy
MD5

ba5c17a57a306f0f7233903f847060ba
SHA1

452cddab195ea591290d309ff10121715bd7f1f8
SHA256

29da4b3ce357e683598f545fb5ffd73c198d1a6084642010b4072125cc72cb86
SHA512

e1899d210224e0b9b2217deb99c08eb5a0a850afd5b62f18ec36f15c740bd7a6340ebdae9b751d3acb37671a8a624f65659abe7640fa3ec83779754baf87b870
SSDEEP

6144:mhdtBhm+BNEW6Uqd2GhNwv/uCaIhInekTtAnVk3RfMofArTufGjK0Vt:4dPhuzUi2iNwnu6InekGnVk3jITP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s18y

Decoy

jokes-online.com

dzzdjn.com

lizzieerhardtebnaryepptts.com

interfacehand.xyz

sale-m.site

block-facebook.com

dicasdamadrinha.com

maythewind.com

hasari.net

omnists.com

thevalley-eg.com

rdfj.xyz

szhfcy.com

alkalineage.club

fdf.xyz

absorplus.com

poldolongo.com

badassshirts.club

ferienwohnungenmv.com

bilboondokoak.com

Targets

- Target
  
  29da4b3ce357e683598f545fb5ffd73c198d1a6084642010b4072125cc72cb86.exe
- Size
  
  482KB
- MD5
  
  ba5c17a57a306f0f7233903f847060ba
- SHA1
  
  452cddab195ea591290d309ff10121715bd7f1f8
- SHA256
  
  29da4b3ce357e683598f545fb5ffd73c198d1a6084642010b4072125cc72cb86
- SHA512
  
  e1899d210224e0b9b2217deb99c08eb5a0a850afd5b62f18ec36f15c740bd7a6340ebdae9b751d3acb37671a8a624f65659abe7640fa3ec83779754baf87b870
- SSDEEP
  
  6144:mhdtBhm+BNEW6Uqd2GhNwv/uCaIhInekTtAnVk3RfMofArTufGjK0Vt:4dPhuzUi2iNwnu6InekGnVk3jITP
Score

10^/10

formbook s18y discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2