formbook

General

Target

18aa3e958673ab344b5a1440c6c22415.bin
Size

764KB
Sample

241126-zl4eyaypfs
MD5

999f372ad4e730455cf84cd6be6fd38f
SHA1

7f161495ff454a2647d0b2dc3797bf4f98673b51
SHA256

885fbde8f586fcc7cfb5f1f3f0b4d58983d2dc54abeb5b3d228fa0755e3fa1cd
SHA512

63370fb7e31d6bdfdf7169546b58d6d335e7c3492a6caf13fa1db6858504007f9b97a90f752d7dfe8608a88a1758465b4e40ebef0ddaaff726b93eaa3c68d78c
SSDEEP

12288:i3d85Dm5SKHHWBCGNqfbABKqXQfdgDGRe83sV4re++mZIyqG1i1FmcJphP3mkkx:eOvKqCUKqXQ1yGRe83KMe++EdnMTnG

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fh84

Decoy

mtzyn.top

zfn-no-hsts.win

j10g.xyz

arehouse-inventory-60572.bond

nlineprodutooffer.shop

ar-deals-77764.bond

e3m2.xyz

cquisitive.group

unkusol.xyz

01307.xyz

uratedcelebrations.net

nfiniworkshop-thai.online

s-cmc.net

idney360.info

ipolar-treatment-us-311-ze.zone

entenstituleridernegi.biz

olombiaoutlet.shop

uradab.rest

qega.shop

73519.vip

Targets

- Target
  
  b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff.exe
- Size
  
  1.0MB
- MD5
  
  18aa3e958673ab344b5a1440c6c22415
- SHA1
  
  507cd39367debb2dd96b19393e38cfa1d1978f91
- SHA256
  
  b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff
- SHA512
  
  c6aafd8c858aa72778895e61840cedae7c66e3316b913d1cd80f44e7ceceae48f655955bc8bbe6b3bd53662d8654c46bad2523b8f663c57675a0545b7fc286ae
- SSDEEP
  
  24576:ffmMv6Ckr7Mny5QLqq/Set8hVp3Q7SS5lQ:f3v+7/5QL14VKS
Score

10^/10

formbook fh84 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2