formbook

General

Target
sgooojg.exe
Size 845KB
Sample250102-rtj29sxqgp
SHA256 6137d6d6b57da5bd4c0c8fb07430ed26fdcfaa58d305629cd46f8d3b3426cd6b
MD5 2bb41efdd9b8f255dcdeec400920adba
SHA1 beefa2b2fcae6e57e52f0a87487b5e83c13d83d8
SHA512 bbbd9c0a867338810cd4815050e16c9ac078a8f5efdbd750c0d548c6d500f434f487d71d7645390859b272ac99ca3272e15bc6874913f1668b3d69689d733a26
SSDEEP 12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLZVTuHkMdv896W6:ffmMv6Ckr7Mny5QLZZ4S6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cl21

Decoy

0001.shop
earch-parttimejobs.today
are888.top
akanhaunthipped.shop
othing-heyu.xyz
cadvirsor.net
nclanalae.shop
lectric-cars-mexico.today
oxj-question.xyz
ersonalloanoffers.today
ersonalloans-fo54-fo37.click
verybody-ewfx.xyz
ercuremontauban.media
azilimdunyam.net
airs-clinicato.today
wiftsscend.click
ertainly-jbws.xyz
8xeng.app
damekadmitageable.cfd
ollapsedec.shop
mpldo.app
g18q29a.top
etaddiction.tech
lbatasalboinamoco.shop
eyyzj-medical.xyz
ote-lmeg.xyz
cellelukacs.shop
evinedesignz11.net
n217.vip
eimy.top
ellisimaa.shop
hjk-west.xyz
nline-dating-be-10.today
wocykmw.top
ytsxv.xyz
iding-lawn-mower.today
olarpergolasolutions.today
ainco.net
r86yd.top
ndrvb-stock.xyz
ing88vn.today
vez3.xyz
fg-am.pro
ultplanlz.click
ecurebet.click
fjng-court.xyz
rsenalatamanaxweed.shop
iaoyingtao16.vip
rime-kvsff.xyz
ufdd-interesting.xyz
qbdl-base.xyz
ushihq.xyz
400108pptddbo685.top
tself-gqemlq.xyz
uyher.shop
ffprintshoplv.shop
ushyniceneobaza.cfd
dmrroa.net
ar-deals-ca-8966160.live
ramx-jorv.top
ifw-less.xyz
hwisdom.net
xrjgq-prepare.xyz
rchertravel.click
ingledatings46.xyz

Targets

- Target
  sgooojg.exe
- Size 845KB
- SHA256 6137d6d6b57da5bd4c0c8fb07430ed26fdcfaa58d305629cd46f8d3b3426cd6b
- MD5 2bb41efdd9b8f255dcdeec400920adba
- SHA1 beefa2b2fcae6e57e52f0a87487b5e83c13d83d8
- SHA512 bbbd9c0a867338810cd4815050e16c9ac078a8f5efdbd750c0d548c6d500f434f487d71d7645390859b272ac99ca3272e15bc6874913f1668b3d69689d733a26
- SSDEEP 12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLZVTuHkMdv896W6:ffmMv6Ckr7Mny5QLZZ4S6
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook cl21 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2