formbook

General

Target

ORDER2024-10-28-3537-121.exe
Size

1.0MB
Sample

241126-znlynsvrhp
MD5

18aa3e958673ab344b5a1440c6c22415
SHA1

507cd39367debb2dd96b19393e38cfa1d1978f91
SHA256

b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff
SHA512

c6aafd8c858aa72778895e61840cedae7c66e3316b913d1cd80f44e7ceceae48f655955bc8bbe6b3bd53662d8654c46bad2523b8f663c57675a0545b7fc286ae
SSDEEP

24576:ffmMv6Ckr7Mny5QLqq/Set8hVp3Q7SS5lQ:f3v+7/5QL14VKS

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fh84

Decoy

mtzyn.top

zfn-no-hsts.win

j10g.xyz

arehouse-inventory-60572.bond

nlineprodutooffer.shop

ar-deals-77764.bond

e3m2.xyz

cquisitive.group

unkusol.xyz

01307.xyz

uratedcelebrations.net

nfiniworkshop-thai.online

s-cmc.net

idney360.info

ipolar-treatment-us-311-ze.zone

entenstituleridernegi.biz

olombiaoutlet.shop

uradab.rest

qega.shop

73519.vip

Targets

- Target
  
  ORDER2024-10-28-3537-121.exe
- Size
  
  1.0MB
- MD5
  
  18aa3e958673ab344b5a1440c6c22415
- SHA1
  
  507cd39367debb2dd96b19393e38cfa1d1978f91
- SHA256
  
  b918f086cc5556f280339d5ce479e7397ce18fe770fef5538379d1ed8f7407ff
- SHA512
  
  c6aafd8c858aa72778895e61840cedae7c66e3316b913d1cd80f44e7ceceae48f655955bc8bbe6b3bd53662d8654c46bad2523b8f663c57675a0545b7fc286ae
- SSDEEP
  
  24576:ffmMv6Ckr7Mny5QLqq/Set8hVp3Q7SS5lQ:f3v+7/5QL14VKS
Score

10^/10

formbook fh84 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2