formbook

Sharing

Copy URL Twitter E-mail

General

Target
7981d6c23a9624544c9610e2cfe5de81a0abfc9022efbd2ff0a514a7be98b93a.exe
Size 1.7MB
Sample250207-reqw9svmaj
SHA256 7981d6c23a9624544c9610e2cfe5de81a0abfc9022efbd2ff0a514a7be98b93a
MD5 00d95adc7ca2126d416fb70f2fae82f3
SHA1 363ec117e50cf867ba5b8b254eee2648d571466b
SHA512 d4d9c81b40aecb71e470c50f2f7d0a26a844d0a0dfc154f51684301d9466137a95df89e756c5732902e84a2a873f76c09b7e61c55ca4f5fc9b7538aaa3f4be8b
SSDEEP 24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8aIn40KXZJnSpepJ8GvkZbccsFq6fT:zTvC/MTQYxsWR7aI4XXupebRqb3so
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

Campaign

hwu6

Decoy

lf758.vip
locerin-hair.shop
vytech.net
pet-insurance-intl-7990489.live
thepolithat.buzz
d66dr114gl.bond
suv-deals-49508.bond
job-offer-53922.bond
drstone1.click
lebahsemesta57.click
olmanihousel.shop
piedmontcsb.info
trisula888x.top
66sodovna.net
dental-implants-83810.bond
imxtld.club
frozenpines.net
ffgzgbl.xyz
tlc7z.rest
alexismuller.design
6vay.boats
moocatinght.top
hafwje.bond
edmaker.online
simo1simo001.click
vbsdconsultant.click
ux-design-courses-53497.bond
victory88-pay.xyz
suarahati7.xyz
otzen.info
hair-transplantation-65829.bond
gequiltdesins.shop
inefity.cloud
jeeinsight.online
86339.xyz
stairr-lift-find.today
wdgb20.top
91uvq.pro
energyecosystem.app
8e5lr5i9zu.buzz
migraine-treatment-36101.bond
eternityzon.shop
43mjqdyetv.sbs
healthcare-software-74448.bond
bethlark.top
dangdut4dselalu.pro
04506.club
rider.vision
health-insurance-cake.world
apoppynote.com
11817e.com
hiefmotelkeokuk.top
sugatoken.xyz
aragamand.business
alifewithoutlimits.info
vibrantsoul.xyz
olarpanels-outlet.info
ozzd86fih4.online
skbdicat.xyz
cloggedpipes.net
ilsgroup.net
ptcnl.info
backstretch.store
maheshg.xyz
7b5846.online

Targets

- Target
  7981d6c23a9624544c9610e2cfe5de81a0abfc9022efbd2ff0a514a7be98b93a.exe
- Size 1.7MB
- SHA256 7981d6c23a9624544c9610e2cfe5de81a0abfc9022efbd2ff0a514a7be98b93a
- MD5 00d95adc7ca2126d416fb70f2fae82f3
- SHA1 363ec117e50cf867ba5b8b254eee2648d571466b
- SHA512 d4d9c81b40aecb71e470c50f2f7d0a26a844d0a0dfc154f51684301d9466137a95df89e756c5732902e84a2a873f76c09b7e61c55ca4f5fc9b7538aaa3f4be8b
- SSDEEP 24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8aIn40KXZJnSpepJ8GvkZbccsFq6fT:zTvC/MTQYxsWR7aI4XXupebRqb3so
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook hwu6 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2