formbook

General

Target
New Order7086.exe
Size 1.3MB
Sample250108-w51xdazrfk
SHA256 92beab1ebf4cb74018b11571a5db867c2ec9d7bb0231a93a898cc3b7799558eb
MD5 0db29bd5e5bc734b26f48f316387571d
SHA1 d4658bd997137cc1c75e9ca0591c5944bd1fe9b5
SHA512 f4c878e20cbe80fd3818758e1703726235fe79bfa55f6cdc0a4affa8e9cdac9fd5929f1c96a268e80681fa54703702ff87ee8faa2c8ec4def30570c2ddb81d95
SSDEEP 24576:XqDEvCTbMWu7rQYlBQcBiT6rprG8aE6ztB8v3egx1H4JBkFt4:XTvC/MTQYxsWR7aEKtBe1H4ne
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

a03d

Decoy

nfluencer-marketing-13524.bond
cebepu.info
lphatechblog.xyz
haoyun.website
itiz.xyz
orld-visa-center.online
si.art
alata.xyz
mmarketing.xyz
elnqdjc.shop
ensentoto.cloud
voyagu.info
onvert.today
1fuli9902.shop
otelhafnia.info
rumpchiefofstaff.store
urvivalflashlights.shop
0090.pizza
ings-hu-13.today
oliticalpatriot.net
5970.pizza
arimatch-in.legal
eepvid.xyz
bfootball.net
otorcycle-loans-19502.bond
nline-advertising-34790.bond
behm.info
aportsystems.store
agiararoma.net
agfov4u.xyz
9769.mobi
ome-renovation-86342.bond
kkkk.shop
duxrib.xyz
xurobo.info
leurdivin.online
ive-neurozoom.store
ndogaming.online
dj1.lat
yselection.xyz
52628.xyz
lsaadmart.store
oftware-download-92806.bond
avid-hildebrand.info
orashrine.store
erpangina-treatment-views.sbs
ategorie-polecane-831.buzz
oonlightshadow.shop
istromarmitaria.online
gmgslzdc.sbs
asglobalaz.shop
locarry.store
eleefmestreech.online
inggraphic.pro
atidiri.fun
olourclubbet.shop
eatbox.store
romatografia.online
encortex.beauty
8oosnny.xyz
72266.vip
aja168e.live
fath.shop
argloscaremedia.info
enelog.xyz

Targets

- Target
  New Order7086.exe
- Size 1.3MB
- SHA256 92beab1ebf4cb74018b11571a5db867c2ec9d7bb0231a93a898cc3b7799558eb
- MD5 0db29bd5e5bc734b26f48f316387571d
- SHA1 d4658bd997137cc1c75e9ca0591c5944bd1fe9b5
- SHA512 f4c878e20cbe80fd3818758e1703726235fe79bfa55f6cdc0a4affa8e9cdac9fd5929f1c96a268e80681fa54703702ff87ee8faa2c8ec4def30570c2ddb81d95
- SSDEEP 24576:XqDEvCTbMWu7rQYlBQcBiT6rprG8aE6ztB8v3egx1H4JBkFt4:XTvC/MTQYxsWR7aEKtBe1H4ne
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook a03d discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2