formbook

Sharing

Copy URL Twitter E-mail

General

Target
03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6.exe
Size 658KB
Sample241203-rrbm4svjer
SHA256 03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6
MD5 c969389f57b8748516c408694e11189e
SHA1 7ec5fbfe88a6a8d54c647bcc73ac315b513fca92
SHA512 7826cf7c6dc9f556b885fcee682c70cfca2da36f4596838bee85427447d6b129e84d9d43e3a31935525bd21a3b1a5b16c17da0155b96ef7e4774099bfbef06db
SSDEEP 12288:Ucir1S2IoOAc6/5rZGmy4unKZno/iDDjPPqmgucrl4M5iYXybz8xaMhLdrn8qdMW:1nK9o67ZguinMbIxaMhJD8yMEE0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

Campaign

fh84

Decoy

mtzyn.top
zfn-no-hsts.win
j10g.xyz
arehouse-inventory-60572.bond
nlineprodutooffer.shop
ar-deals-77764.bond
e3m2.xyz
cquisitive.group
unkusol.xyz
01307.xyz
uratedcelebrations.net
nfiniworkshop-thai.online
s-cmc.net
idney360.info
ipolar-treatment-us-311-ze.zone
entenstituleridernegi.biz
olombiaoutlet.shop
uradab.rest
qega.shop
73519.vip
legantea.net
tudyinaustraliamy.today
treetsofsanfrancisco.shop
asino-pinup-slots2.online
7yptkxx.forum
8745.net
15dm143lk.autos
ethalmine.xyz
races-dental-splints-52226.bond
angerouslyliberalkamala.info
roker.autos
w-br.online
afenorah.xyz
ell-phones-search-jp.today
affasnacks.info
asksksmsms.xyz
hopsoimod.online
hebespokebrief.info
acman.world
nfotrackptc.top
ecurity-apps-89277.bond
37pg-games.pro
pfzm.top
nalyticdata.xyz
uymetanail2.online
ohnpaulgetty.xyz
kewpura.cfd
mpg777.top
rendinghawaiianshirt.net
ldsoul.nyc
ai-paaab.buzz
anielpeninmasterclass.pro
fficialpromotion.shop
irconditionerjobs-2fb.click
etropixelshop.info
uy-smart-tv-ar.today
roperties-for-rent-39228.bond
t-m.xyz
nmnm.top
lsdao.xyz
ltacourierr.buzz
oin-mailer.app
ceanlovers.net
rozenservice.online
partments-for-rent-gurus.sbs

Targets

- Target
  03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6.exe
- Size 658KB
- SHA256 03369b54bd959d9f0f02b5ce734d502ddcddfee109fed5345c84ae0f365bebf6
- MD5 c969389f57b8748516c408694e11189e
- SHA1 7ec5fbfe88a6a8d54c647bcc73ac315b513fca92
- SHA512 7826cf7c6dc9f556b885fcee682c70cfca2da36f4596838bee85427447d6b129e84d9d43e3a31935525bd21a3b1a5b16c17da0155b96ef7e4774099bfbef06db
- SSDEEP 12288:Ucir1S2IoOAc6/5rZGmy4unKZno/iDDjPPqmgucrl4M5iYXybz8xaMhLdrn8qdMW:1nK9o67ZguinMbIxaMhJD8yMEE0
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook fh84 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2