formbook

General

Target

RFQ PC25-1301 Product Specifications_PDF_1.7z
Size

922KB
Sample

250116-p22k6s1lhv
MD5

57b7d37a9a3264d4a99a353777a64933
SHA1

79f150fc363e6ea85b9374ab900b432e37482a28
SHA256

4b65fd00c79cab6965f113c749c2ba71f9b323d69e42bfa6ae7966706fbad227
SHA512

8a34368c4b35931cda89da2ba3743f84284453249003ba5149f0b94fee0286b121ec119c3765e8d84ff1d5fbf77ce240b6d98396d155a0c86b77c92d3bc4a02c
SSDEEP

12288:spwCXju32tfvvT8hOMxZkObl8Y9qjjQ8KzAd/7bC0SFStxST6sO7gxNCksp/0ReO:IweGofv7exWvjNKEdKq74NY/aN

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hwu6

Decoy

lf758.vip

locerin-hair.shop

vytech.net

pet-insurance-intl-7990489.live

thepolithat.buzz

d66dr114gl.bond

suv-deals-49508.bond

job-offer-53922.bond

drstone1.click

lebahsemesta57.click

olmanihousel.shop

piedmontcsb.info

trisula888x.top

66sodovna.net

dental-implants-83810.bond

imxtld.club

frozenpines.net

ffgzgbl.xyz

tlc7z.rest

alexismuller.design

Targets

- Target
  
  RFQ PC25-1301 Product Specifications_PDF.exe
- Size
  
  1.7MB
- MD5
  
  01b5875dce3957e3aa4a407551e2c4ba
- SHA1
  
  96e0fb3b858c9f28445955b8cee19e698d44f815
- SHA256
  
  fe242ebf2305cc96041ef027f7cdad6efe3ba1cf3aab07bb37357359452205d4
- SHA512
  
  c00aa40db746e6074d0bbad6c14dc840b32e53c12a484405c7b95912bcf056eb47b3fc7b110beb57d1a8e6c9f90e480a55a7be930d2ca2caf03fec6f31e06f7f
- SSDEEP
  
  24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8at6FWvjTrmY44PhUY1sooWNf/w:sTvC/MTQYxsWR7aYFWvjTax4Jve
Score

10^/10

formbook hwu6 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Blocklisted process makes network request

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2