formbook

Sharing

Copy URL Twitter E-mail

General

Target
93f387ba0662e9f64bb29ab6862152d7ae206f36938a63b23b284c64f2a2ee0f
Size 835KB
Sample250117-e3h54ssjbs
SHA256 93f387ba0662e9f64bb29ab6862152d7ae206f36938a63b23b284c64f2a2ee0f
MD5 07b48dc44712ef74cfcad95b49dbb6e1
SHA1 5ebd03025f12edf087799dc88ef3cae8d127aba7
SHA512 a69b24a514758086cc8e42336896d50ee372dc3c5ea7c982ca14e063e274f4a91ee67d69329225934395958a50836c337af6055fba96470208d2d9cc36cf936f
SSDEEP 24576:FA7ZO/wM1/2gPvT/PJgIi38ruoFdWpcGD:FAY522JfVamYD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

Campaign

g49t

Decoy

oast.now
11av1805.xyz
ourse.sale
nfoaldyfbvmdgfat.buzz
ntli.biz
apidrotation.net
ourmet94goodies.shop
eeksee.fun
aamahsa-emer6.rest
he-eyeofgod.online
ctofoot.net
ellnessdigitalmedia.store
0999yh.one
inghoki88.pro
sg.productions
basicwardrobe.club
itansofwisdom.fun
leaning-services-46734.bond
dinhk.online
arcelaamiga.shop
edicsanonymous.online
potloans.live
hermocontrol.xyz
arehouse-inventory-93551.bond
lockchain.xxx
om-tarewo.icu
ushmore.construction
rombeyond.xyz
epression-test-52238.bond
oiyter.xyz
etva.online
arbiequiz.shop
ransmediatupa.store
erali.rest
ox-packaging-jobs11.online
ebastianschlosser.xyz
hetrumpet.news
sefiorella.online
ifechanging.charity
5q04.net
jso.net
uantuminternship.online
bngy.shop
rabul.xyz
atxyzdes.live
ewrefope.xyz
dwardjrhuntley.online
erfectescapes.vacations
ntfqz.info
linds-curtains-47952.bond
nsidechina.online
ickanddrive.online
oisv.info
irro.mobi
eqiachat3.christmas
hampioon-slotss.vin
rilens.online
ydhl.life
ormuladedesconectar.shop
epression-test-87609.bond
asik-eye-surgery-90605.bond
raveheart2.online
tejarat.online
raftmine.xyz
radantobin.photography

Targets

- Target
  ORDER ENQIRY #093727664.exe
- Size 1.3MB
- SHA256 f65ec81dc8f5d0a0a1f53752cdc2bb933e2897a91091f28b8d1702ffe207481c
- MD5 6c307da605db691944e35458f2a5b772
- SHA1 b89158e370a8658cf3a6ed2bb78925e004034905
- SHA512 2c3dc98e9850a509d30b556c5bbc0941735ef26cfcb45cf23392a1c9e23012dd46d9916792c5c559d5cb2a3b27b1d96bfdf7d89f9f1b01db7bfc2630b17dfe17
- SSDEEP 24576:bqDEvCTbMWu7rQYlBQcBiT6rprG8aj1BV+opERjUD4TV3Y4M1:bTvC/MTQYxsWR7ajTkoUUwJY
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook g49t discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2