formbook

General

Target

0db29bd5e5bc734b26f48f316387571d.bin
Size

891KB
Sample

250110-bc12fswngy
MD5

1698a7eadd8486c9183b4870d8c6890f
SHA1

fb2e8281c87392dda07c9ebca36f13f4d125892c
SHA256

8b6017c0273a53df2ceda06cfabb8401c1441fc0f15ff976eb09ded799f68622
SHA512

e94c3f4999f50142b744499e254e421354dade199643326b5afdce5904aae7701cd0f2274e5d7c0b7e8a5b6a142cc7c050671921d619c3c4d804042110e23066
SSDEEP

24576:9n4stNJBfyxGi7+HU4bgJFA5u6cDcqirhF:9n4sv3fjgDA52D5wF

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

a03d

Decoy

nfluencer-marketing-13524.bond

cebepu.info

lphatechblog.xyz

haoyun.website

itiz.xyz

orld-visa-center.online

si.art

alata.xyz

mmarketing.xyz

elnqdjc.shop

ensentoto.cloud

voyagu.info

onvert.today

1fuli9902.shop

otelhafnia.info

rumpchiefofstaff.store

urvivalflashlights.shop

0090.pizza

ings-hu-13.today

oliticalpatriot.net

Targets

- Target
  
  92beab1ebf4cb74018b11571a5db867c2ec9d7bb0231a93a898cc3b7799558eb.exe
- Size
  
  1.3MB
- MD5
  
  0db29bd5e5bc734b26f48f316387571d
- SHA1
  
  d4658bd997137cc1c75e9ca0591c5944bd1fe9b5
- SHA256
  
  92beab1ebf4cb74018b11571a5db867c2ec9d7bb0231a93a898cc3b7799558eb
- SHA512
  
  f4c878e20cbe80fd3818758e1703726235fe79bfa55f6cdc0a4affa8e9cdac9fd5929f1c96a268e80681fa54703702ff87ee8faa2c8ec4def30570c2ddb81d95
- SSDEEP
  
  24576:XqDEvCTbMWu7rQYlBQcBiT6rprG8aE6ztB8v3egx1H4JBkFt4:XTvC/MTQYxsWR7aEKtBe1H4ne
Score

10^/10

formbook a03d discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2