formbook

General

Target

2bb41efdd9b8f255dcdeec400920adba.bin
Size

545KB
Sample

250104-bg3e3svqer
MD5

f589d5a9432b5eb521981d365bf7ec2f
SHA1

2668189ee93ca65598c104a8e956520db25c757a
SHA256

44969effc15cfdc61ddcdec0dc690ff5d11f76b510fd07e957d973d78343b15a
SHA512

6304594907266697a07bcdbacb9064693b24943e6f880b623c7e87229f168d2938fe4f3b26b10b6a5b407f014d7e79ccdb8b8fbeee5ca7f23d6845728e275890
SSDEEP

12288:0vz7ngYfA/S1vglBaERh2lLE70ECWy/egornQIzUvNnW0yf:0XnKS9gl8FLQOYjQNvZsf

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cl21

Decoy

0001.shop

earch-parttimejobs.today

are888.top

akanhaunthipped.shop

othing-heyu.xyz

cadvirsor.net

nclanalae.shop

lectric-cars-mexico.today

oxj-question.xyz

ersonalloanoffers.today

ersonalloans-fo54-fo37.click

verybody-ewfx.xyz

ercuremontauban.media

azilimdunyam.net

airs-clinicato.today

wiftsscend.click

ertainly-jbws.xyz

8xeng.app

damekadmitageable.cfd

ollapsedec.shop

Targets

- Target
  
  6137d6d6b57da5bd4c0c8fb07430ed26fdcfaa58d305629cd46f8d3b3426cd6b.exe
- Size
  
  845KB
- MD5
  
  2bb41efdd9b8f255dcdeec400920adba
- SHA1
  
  beefa2b2fcae6e57e52f0a87487b5e83c13d83d8
- SHA256
  
  6137d6d6b57da5bd4c0c8fb07430ed26fdcfaa58d305629cd46f8d3b3426cd6b
- SHA512
  
  bbbd9c0a867338810cd4815050e16c9ac078a8f5efdbd750c0d548c6d500f434f487d71d7645390859b272ac99ca3272e15bc6874913f1668b3d69689d733a26
- SSDEEP
  
  12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLZVTuHkMdv896W6:ffmMv6Ckr7Mny5QLZZ4S6
Score

10^/10

discovery formbook cl21 rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2