formbook

General

Target

f43fcf8e27da60e8295eed641aa845de83bb90e8e4e29ad90722e2f72236cb66.exe
Size

1.0MB
Sample

241127-dwgs2avjft
MD5

a44cd4afa52a450fa94c656b8d760339
SHA1

09e74273689360524e0afb2f394675d6753867b4
SHA256

f43fcf8e27da60e8295eed641aa845de83bb90e8e4e29ad90722e2f72236cb66
SHA512

a9e244674485d5d54efd79156c893b375f6a183404225520fb9ac501cd1fd8a99dd6faee6ce777a77996b6106bea91dbba0cc56b7ebf9af9bf8a6f1cb909d833
SSDEEP

24576:3AHnh+eWsN3skA4RV1Hom2KXMmHaGNrTAVTZN6EP5:qh+ZkldoPK8YaGx+24

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ma28

Decoy

orth.monster

5970.pizza

oinayangi.net

usiness-funding-48965.bond

uttere.buzz

raumainformed.xyz

amewith.today

hetangosalon.net

irewoodprice168.shop

commerce-96305.bond

3107.loan

uohan.tech

agakaw.website

fricaduka.store

ecga.info

arehouse-inventory-27582.bond

itchen-design-87997.bond

eishahousesteaksushi.shop

liopew.xyz

4769.pizza

Targets

- Target
  
  f43fcf8e27da60e8295eed641aa845de83bb90e8e4e29ad90722e2f72236cb66.exe
- Size
  
  1.0MB
- MD5
  
  a44cd4afa52a450fa94c656b8d760339
- SHA1
  
  09e74273689360524e0afb2f394675d6753867b4
- SHA256
  
  f43fcf8e27da60e8295eed641aa845de83bb90e8e4e29ad90722e2f72236cb66
- SHA512
  
  a9e244674485d5d54efd79156c893b375f6a183404225520fb9ac501cd1fd8a99dd6faee6ce777a77996b6106bea91dbba0cc56b7ebf9af9bf8a6f1cb909d833
- SSDEEP
  
  24576:3AHnh+eWsN3skA4RV1Hom2KXMmHaGNrTAVTZN6EP5:qh+ZkldoPK8YaGx+24
Score

10^/10

formbook ma28 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2