formbook

General

Target
ETM0424-02-BF.exe
Size 1.1MB
Sample241128-rl9mysznbx
SHA256 6e5961837c9fb36c834e5972dd5448b5794bee50142db8ae3481e8b2dd2b8f36
MD5 daf47fbb5607db204ba3e3ccc363df40
SHA1 ee304b632161ff9058258255b92860eb6f930862
SHA512 d62c9aa7fca741ce839c634b728a810b39d85a47c302af05fe8d02955d865bcac06bd3b5a550723fdf15b2ed13e55a50caf2b88df4fe8ef472b354b37f3c83e0
SSDEEP 24576:etb20pkaCqT5TBWgNQ7aSimKPkDLf2V6A:LVg5tQ7aSiXou5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cl21

Decoy

0001.shop
earch-parttimejobs.today
are888.top
akanhaunthipped.shop
othing-heyu.xyz
cadvirsor.net
nclanalae.shop
lectric-cars-mexico.today
oxj-question.xyz
ersonalloanoffers.today
ersonalloans-fo54-fo37.click
verybody-ewfx.xyz
ercuremontauban.media
azilimdunyam.net
airs-clinicato.today
wiftsscend.click
ertainly-jbws.xyz
8xeng.app
damekadmitageable.cfd
ollapsedec.shop
mpldo.app
g18q29a.top
etaddiction.tech
lbatasalboinamoco.shop
eyyzj-medical.xyz
ote-lmeg.xyz
cellelukacs.shop
evinedesignz11.net
n217.vip
eimy.top
ellisimaa.shop
hjk-west.xyz
nline-dating-be-10.today
wocykmw.top
ytsxv.xyz
iding-lawn-mower.today
olarpergolasolutions.today
ainco.net
r86yd.top
ndrvb-stock.xyz
ing88vn.today
vez3.xyz
fg-am.pro
ultplanlz.click
ecurebet.click
fjng-court.xyz
rsenalatamanaxweed.shop
iaoyingtao16.vip
rime-kvsff.xyz
ufdd-interesting.xyz
qbdl-base.xyz
ushihq.xyz
400108pptddbo685.top
tself-gqemlq.xyz
uyher.shop
ffprintshoplv.shop
ushyniceneobaza.cfd
dmrroa.net
ar-deals-ca-8966160.live
ramx-jorv.top
ifw-less.xyz
hwisdom.net
xrjgq-prepare.xyz
rchertravel.click
ingledatings46.xyz

Targets

- Target
  ETM0424-02-BF.exe
- Size 1.1MB
- SHA256 6e5961837c9fb36c834e5972dd5448b5794bee50142db8ae3481e8b2dd2b8f36
- MD5 daf47fbb5607db204ba3e3ccc363df40
- SHA1 ee304b632161ff9058258255b92860eb6f930862
- SHA512 d62c9aa7fca741ce839c634b728a810b39d85a47c302af05fe8d02955d865bcac06bd3b5a550723fdf15b2ed13e55a50caf2b88df4fe8ef472b354b37f3c83e0
- SSDEEP 24576:etb20pkaCqT5TBWgNQ7aSimKPkDLf2V6A:LVg5tQ7aSiXou5
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook cl21 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2