formbook

General

Target

Invoice ETM0424-02-B.rar
Size

584KB
Sample

241127-dfmdkszpdl
MD5

205d145695c9baaad734b9e51bf1ed07
SHA1

c81acf11b8a9bd701594d692a44da8424417b5af
SHA256

7f6e3386bf352d8d9c0ff3868a8a71bf0d15628789956b443e6ba630e4acf5e2
SHA512

ce04fdc59419c560188c2d7913e83815ed12202fec1922f11ae9b583a96cfb386731e0af9f8caed16f6b264892afde797b5caad7aea1be2133ea6815d789cff6
SSDEEP

12288:yyRdHgIqAyWv76QbqCiYlsDKHgbH/gYR+TJwnn/FoX6ceqqJ9NO:vfAGxb8YcB7/nRI2/qwJrO

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cl21

Decoy

0001.shop

earch-parttimejobs.today

are888.top

akanhaunthipped.shop

othing-heyu.xyz

cadvirsor.net

nclanalae.shop

lectric-cars-mexico.today

oxj-question.xyz

ersonalloanoffers.today

ersonalloans-fo54-fo37.click

verybody-ewfx.xyz

ercuremontauban.media

azilimdunyam.net

airs-clinicato.today

wiftsscend.click

ertainly-jbws.xyz

8xeng.app

damekadmitageable.cfd

ollapsedec.shop

Targets

- Target
  
  Invoice -BF.exe
- Size
  
  1.1MB
- MD5
  
  a574d8e90f0174f5fe30edb676b9f106
- SHA1
  
  e5a008bf01cf36c343fc9d90fc8d728524e33fe5
- SHA256
  
  d2c3ec17a82adc64cbf865b806ea8df48efcee31a55e5ee6e61de3dccbbcf6bf
- SHA512
  
  04653911205ec9f3c093ac6640cfcd42ef9cd45924c6536d7bf721db672d4459a24c79bfb9771165d2a80cbcf613ca3fd7e481360a0c3498d8c2b33b711ce532
- SSDEEP
  
  24576:0tb20pkaCqT5TBWgNQ7ap4hb3i8jR16n6A:dVg5tQ7apijs5
Score

10^/10

formbook cl21 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2