formbook

General

Target

RFQ PC25-1301 Product Specifications_PDF.exe
Size

1.7MB
Sample

250113-n8lb4atmhr
MD5

f1cb41be3365b899a74d919df902fc08
SHA1

befff58e08b3adc2058f51c884067e59708e17d3
SHA256

d59aedcde68dc8275a3ad53be28c1588790b2e5da2258a66d4492c5a7c67a7c1
SHA512

17ebb6eb1c3273dd3326267fe0633dbedf737ff8a90282e92d91141a1f6ae81037afe3b42f0c3e0e20301045168bc0be81aa26d3d11bce826c0d5b5d1413adc8
SSDEEP

24576:KqDEvCTbMWu7rQYlBQcBiT6rprG8aFhKG+mre6oRTOtTOUIClacTL:KTvC/MTQYxsWR7aFhKG+mrJ+OtNIU

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hwu6

Decoy

lf758.vip

locerin-hair.shop

vytech.net

pet-insurance-intl-7990489.live

thepolithat.buzz

d66dr114gl.bond

suv-deals-49508.bond

job-offer-53922.bond

drstone1.click

lebahsemesta57.click

olmanihousel.shop

piedmontcsb.info

trisula888x.top

66sodovna.net

dental-implants-83810.bond

imxtld.club

frozenpines.net

ffgzgbl.xyz

tlc7z.rest

alexismuller.design

Targets

- Target
  
  RFQ PC25-1301 Product Specifications_PDF.exe
- Size
  
  1.7MB
- MD5
  
  f1cb41be3365b899a74d919df902fc08
- SHA1
  
  befff58e08b3adc2058f51c884067e59708e17d3
- SHA256
  
  d59aedcde68dc8275a3ad53be28c1588790b2e5da2258a66d4492c5a7c67a7c1
- SHA512
  
  17ebb6eb1c3273dd3326267fe0633dbedf737ff8a90282e92d91141a1f6ae81037afe3b42f0c3e0e20301045168bc0be81aa26d3d11bce826c0d5b5d1413adc8
- SSDEEP
  
  24576:KqDEvCTbMWu7rQYlBQcBiT6rprG8aFhKG+mre6oRTOtTOUIClacTL:KTvC/MTQYxsWR7aFhKG+mrJ+OtNIU
Score

10^/10

formbook hwu6 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2