formbook | 6febe41ce943833972b3806d774a413eeda3b40d07487888a873aa20054df6c2 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

5

b684a4d4ed...f2.exe

windows7-x64

b684a4d4ed...f2.exe

windows10-2004-x64

Sharing

General

Target

a5cb15ed7122efdebf1f6c293e1bebce.bin
Size

545KB
Sample

250101-bygjyasjbn
MD5

7261e11231a9e99e88d4691fe140f638
SHA1

c8dfefa841f38bd2d3565e869d5fba7a346a1511
SHA256

6febe41ce943833972b3806d774a413eeda3b40d07487888a873aa20054df6c2
SHA512

03c72095014904f027263706389b1f9e2677ae513063c900c51dcd6c4490340bc071b40ff9b1883ac9150cc8e6b34807226162010904dbc57fe30e2d19179e58
SSDEEP

12288:aNZaxytzEv9myfdX0aalSarjYjU7cc95w7MWTNMlM9oPixKMb8Mm6jGRRoM3/:ajaxytzEldXpaIafYQocw7MWg/hc8RRb

Score

10^/10

formbook cl21 discovery rat spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

b684a4d4ed1ab38535abe13ad1c41bb03bd742ec93d3384ca382ca7b146fb3f2.exe

Resource

win7-20240903-en

formbook cl21 discovery rat spyware stealer trojan

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

b684a4d4ed1ab38535abe13ad1c41bb03bd742ec93d3384ca382ca7b146fb3f2.exe

Resource

win10v2004-20241007-en

formbook cl21 discovery rat spyware stealer trojan

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cl21

Decoy

0001.shop

earch-parttimejobs.today

are888.top

akanhaunthipped.shop

othing-heyu.xyz

cadvirsor.net

nclanalae.shop

lectric-cars-mexico.today

oxj-question.xyz

ersonalloanoffers.today

ersonalloans-fo54-fo37.click

verybody-ewfx.xyz

ercuremontauban.media

azilimdunyam.net

airs-clinicato.today

wiftsscend.click

ertainly-jbws.xyz

8xeng.app

damekadmitageable.cfd

ollapsedec.shop

mpldo.app

g18q29a.top

etaddiction.tech

lbatasalboinamoco.shop

eyyzj-medical.xyz

ote-lmeg.xyz

cellelukacs.shop

evinedesignz11.net

n217.vip

eimy.top

ellisimaa.shop

hjk-west.xyz

nline-dating-be-10.today

wocykmw.top

ytsxv.xyz

iding-lawn-mower.today

olarpergolasolutions.today

ainco.net

r86yd.top

ndrvb-stock.xyz

ing88vn.today

vez3.xyz

fg-am.pro

ultplanlz.click

ecurebet.click

fjng-court.xyz

rsenalatamanaxweed.shop

iaoyingtao16.vip

rime-kvsff.xyz

ufdd-interesting.xyz

qbdl-base.xyz

ushihq.xyz

400108pptddbo685.top

tself-gqemlq.xyz

uyher.shop

ffprintshoplv.shop

ushyniceneobaza.cfd

dmrroa.net

ar-deals-ca-8966160.live

ramx-jorv.top

ifw-less.xyz

hwisdom.net

xrjgq-prepare.xyz

rchertravel.click

ingledatings46.xyz

Targets

- Target
  
  b684a4d4ed1ab38535abe13ad1c41bb03bd742ec93d3384ca382ca7b146fb3f2.exe
- Size
  
  845KB
- MD5
  
  a5cb15ed7122efdebf1f6c293e1bebce
- SHA1
  
  78bb4a292d3e063cc5a771516a68016fef978996
- SHA256
  
  b684a4d4ed1ab38535abe13ad1c41bb03bd742ec93d3384ca382ca7b146fb3f2
- SHA512
  
  01f2a7e9a5d8029345ae5ff6642feef4e7ae9b307f79487a38cb9ae5cbdc85096a98a4537bf4938704796d7514cecc7b4ad811f34b07d1cb6ce40d09c9fc34e0
- SSDEEP
  
  12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLCCcTcZfmrjHdPu/VA3pAltdNmDTg29:ffmMv6Ckr7Mny5QLHchrjRGVAq7mfv
Score

10^/10

formbook cl21 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

formbookcl21discoveryratspywarestealertrojan

behavioral2

formbookcl21discoveryratspywarestealertrojan

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.