formbook

General

Target

379c2e817f523d893d2392ea0ae2689b4308dde7882e50923400610ef971b8c4.7z
Size

877KB
Sample

250116-c3jqjaxlgz
MD5

e153ca25013d46ff8bb33fefb3c7defe
SHA1

e712201f0b1236c86fa572de634fb579a90fa413
SHA256

379c2e817f523d893d2392ea0ae2689b4308dde7882e50923400610ef971b8c4
SHA512

bb393bf3c2bd46be86f23eef06a00d0790d1e16644c764943b4463c287a88366e6b29d3e83964623095c10cb68f722386f605c5fc67dfa402e66db7237dcc76a
SSDEEP

24576:3V/Pc7k/koPw115B6mPICGZ+B/xomeHHnkCh:3V3ok/koPw1156hMBJom4H/

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hwu6

Decoy

lf758.vip

locerin-hair.shop

vytech.net

pet-insurance-intl-7990489.live

thepolithat.buzz

d66dr114gl.bond

suv-deals-49508.bond

job-offer-53922.bond

drstone1.click

lebahsemesta57.click

olmanihousel.shop

piedmontcsb.info

trisula888x.top

66sodovna.net

dental-implants-83810.bond

imxtld.club

frozenpines.net

ffgzgbl.xyz

tlc7z.rest

alexismuller.design

Targets

- Target
  
  RFQ PC25-1301 Product Specifications_PDF.exe
- Size
  
  1.4MB
- MD5
  
  47b4b12ff498d2620dd824b86ba20e98
- SHA1
  
  c563ff933dd402ed4734c5f2030bf0bc8afd46c6
- SHA256
  
  4af879a5ba55d1f85555bef2423b273f87df5db31d540934572ab4439e062545
- SHA512
  
  e19bf614de75c3b858726422817344a1ebc920b6daa9a8daec9fbef43e47a1ea218999473ab0ff53beead5a093e29a277d04a8cf2f811d38ad9b966d77212dce
- SSDEEP
  
  24576:eqDEvCTbMWu7rQYlBQcBiT6rprG8a74mPIiJZ+6/x7me8bQVe:eTvC/MTQYxsWR7a72mM6J7mp8
Score

10^/10

formbook hwu6 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2