formbook

General

Target

519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe
Size

1.4MB
Sample

241224-eaxsss1ngj
MD5

b96e6785937bd52b1281fb98f0abcf25
SHA1

d27572ada589769bfdb99dabbd485556e39010ba
SHA256

519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514
SHA512

39aadf908dcbb16588e5a93f7c633224d3ba7aa3bed54ae96e3fb9320fc080b6da7987b8d66d279266045b1aaafc1788b47bb72558ff42371acd55e8f768304d
SSDEEP

24576:Gtb20pkaCqT5TBWgNQ7aMhKG+mrh1JPUc9g56A:zVg5tQ7aMhKG+mrPVD9k5

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hwu6

Decoy

lf758.vip

locerin-hair.shop

vytech.net

pet-insurance-intl-7990489.live

thepolithat.buzz

d66dr114gl.bond

suv-deals-49508.bond

job-offer-53922.bond

drstone1.click

lebahsemesta57.click

olmanihousel.shop

piedmontcsb.info

trisula888x.top

66sodovna.net

dental-implants-83810.bond

imxtld.club

frozenpines.net

ffgzgbl.xyz

tlc7z.rest

alexismuller.design

Targets

- Target
  
  519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514.exe
- Size
  
  1.4MB
- MD5
  
  b96e6785937bd52b1281fb98f0abcf25
- SHA1
  
  d27572ada589769bfdb99dabbd485556e39010ba
- SHA256
  
  519678c24f6036d935bdd915090f07ad1fea068dc2491861648c6b00698de514
- SHA512
  
  39aadf908dcbb16588e5a93f7c633224d3ba7aa3bed54ae96e3fb9320fc080b6da7987b8d66d279266045b1aaafc1788b47bb72558ff42371acd55e8f768304d
- SSDEEP
  
  24576:Gtb20pkaCqT5TBWgNQ7aMhKG+mrh1JPUc9g56A:zVg5tQ7aMhKG+mrPVD9k5
Score

10^/10

formbook hwu6 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2