formbook

General

Target

d25aa55294fe6a2e98ba3c985c3182d745c511754c03ae7b4080133a8bb2e3bd.exe
Size

555KB
Sample

241204-dxth8azjbw
MD5

216a05801c02456a6675279aca58fca5
SHA1

92bb781c73643d3008960150c1094f2e581425f9
SHA256

d25aa55294fe6a2e98ba3c985c3182d745c511754c03ae7b4080133a8bb2e3bd
SHA512

02c8619ed6aceb1ae2275afd2727601af9bb64a1e29d6ff675f7d6f9e7be0b0ccb20eaa976856ef074553716b12961976f57ccb08a34391ef1775faf84130d34
SSDEEP

12288:OHUS8GnuZnSyBHYnS987bDoqSJMpY6GZfB:OvmDBHqS90IMpYHZfB

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fh84

Decoy

mtzyn.top

zfn-no-hsts.win

j10g.xyz

arehouse-inventory-60572.bond

nlineprodutooffer.shop

ar-deals-77764.bond

e3m2.xyz

cquisitive.group

unkusol.xyz

01307.xyz

uratedcelebrations.net

nfiniworkshop-thai.online

s-cmc.net

idney360.info

ipolar-treatment-us-311-ze.zone

entenstituleridernegi.biz

olombiaoutlet.shop

uradab.rest

qega.shop

73519.vip

Targets

- Target
  
  d25aa55294fe6a2e98ba3c985c3182d745c511754c03ae7b4080133a8bb2e3bd.exe
- Size
  
  555KB
- MD5
  
  216a05801c02456a6675279aca58fca5
- SHA1
  
  92bb781c73643d3008960150c1094f2e581425f9
- SHA256
  
  d25aa55294fe6a2e98ba3c985c3182d745c511754c03ae7b4080133a8bb2e3bd
- SHA512
  
  02c8619ed6aceb1ae2275afd2727601af9bb64a1e29d6ff675f7d6f9e7be0b0ccb20eaa976856ef074553716b12961976f57ccb08a34391ef1775faf84130d34
- SSDEEP
  
  12288:OHUS8GnuZnSyBHYnS987bDoqSJMpY6GZfB:OvmDBHqS90IMpYHZfB
Score

10^/10

formbook fh84 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2