formbook

General

Target

RFQ2332025.r15.rar
Size

834KB
Sample

250109-kkac5svlgw
MD5

4f747c9d55daf9571c457ba423f5cf72
SHA1

01c62386e73ce5f0b5e94ec73511a2ab4fc1d380
SHA256

9c04d567492659d7a5344a9a64fe79f93d7b2063a9e6a1f21068023bd4f96af0
SHA512

176628c2e27d9316447a772bc065014e3054ec777dc45429380ada63f268e0e1f8f8258887c8d0540f0ace152c396b456381681e65a5955340ab639e35cea6c1
SSDEEP

24576:B54eJgvgql6kTo88MEBawJsPE/X7N9FEy+tdObnf1:zmRV8MEBZs87NTB+tIbnt

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

a02d

Decoy

coplus.market

oofing-jobs-74429.bond

healchemists.xyz

oofcarpenternearme-jp.xyz

enewebsolutions.online

harepoint.legal

88977.club

omptables.xyz

eat-pumps-31610.bond

endown.graphics

amsexgirls.website

ovevibes.xyz

u-thiensu.online

yblinds.xyz

rumpchiefofstaff.store

erzog.fun

rrm.lat

agiclime.pro

agaviet59.shop

lbdoanhnhan.net

Targets

- Target
  
  sssddhhing.exe
- Size
  
  1.3MB
- MD5
  
  17374c7c08d5a0bc971e2988f2364c8c
- SHA1
  
  dc9fd0ec4c80aadd53b77c3d920e0dc2c6b192ce
- SHA256
  
  397015a1428f2ee24e69d670f97b98f744039041eaea4e9836a27b01ce96b793
- SHA512
  
  54ffdd249cf89082816038e26cb2dce60397965a7e9ce4222488b93f3b1762d2aee9cfbf3b952aaaa5871ddf34ed4a2067b03d1a0e0fd966f2dd7f4a7318af00
- SSDEEP
  
  24576:AqDEvCTbMWu7rQYlBQcBiT6rprG8adaxlGbI5d5tRp2FpiLYtul:ATvC/MTQYxsWR7adaXt2jwx
Score

10^/10

formbook a02d discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2