formbook

General

Target

72312625fba0c0237c06eb131c554376df142b4ef0bb514f47e1655b6064948d.r00
Size

496KB
Sample

250103-d6yjjaxqhw
MD5

9f69c3a07d22a1d33a24cdaa0140225c
SHA1

4fdc8dd93e5b3ad8064ee4b94010d6ff93c06b61
SHA256

72312625fba0c0237c06eb131c554376df142b4ef0bb514f47e1655b6064948d
SHA512

bc5aa386f287a43259516b6296b3112f0a3b79ffd8141ef07608a5bfd48343544dff214f0f897d522f92b6bc42c1234033e1935700b728d0a4b24fbb957fc792
SSDEEP

12288:lUPVfPEAk0bBilcw/H9ZJ/HvZuHEHPAtTioksFPe2V2q:YXk0FilX14EHR328q

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cl21

Decoy

0001.shop

earch-parttimejobs.today

are888.top

akanhaunthipped.shop

othing-heyu.xyz

cadvirsor.net

nclanalae.shop

lectric-cars-mexico.today

oxj-question.xyz

ersonalloanoffers.today

ersonalloans-fo54-fo37.click

verybody-ewfx.xyz

ercuremontauban.media

azilimdunyam.net

airs-clinicato.today

wiftsscend.click

ertainly-jbws.xyz

8xeng.app

damekadmitageable.cfd

ollapsedec.shop

Targets

- Target
  
  sgooojg.exe
- Size
  
  845KB
- MD5
  
  2bb41efdd9b8f255dcdeec400920adba
- SHA1
  
  beefa2b2fcae6e57e52f0a87487b5e83c13d83d8
- SHA256
  
  6137d6d6b57da5bd4c0c8fb07430ed26fdcfaa58d305629cd46f8d3b3426cd6b
- SHA512
  
  bbbd9c0a867338810cd4815050e16c9ac078a8f5efdbd750c0d548c6d500f434f487d71d7645390859b272ac99ca3272e15bc6874913f1668b3d69689d733a26
- SSDEEP
  
  12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLZVTuHkMdv896W6:ffmMv6Ckr7Mny5QLZZ4S6
Score

10^/10

discovery formbook cl21 rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2