formbook

General

Target
VZXBSD.exe
Size 224KB
Sample250422-nsf3faxrt3
SHA256 896dacfb811fcde80b97bb497aa5abc2dc3bcdedae8c0791512b208aea6b65bf
MD5 88bc69b054558e4f2dc95106a1c3e3a8
SHA1 1a0a747e267376860c3e2e764188cd6ff7895a86
SHA512 19c2a8601409e98d69faae1437c1caa4bb26ee708f205e332a85854cf14aa145e8689e21e6df4240eeb3a2ad929e273dff6d0cec55e50ecd1f5e51784aae3457
SSDEEP 6144:/OTn2z/v8iDhDqiAS8rNsZ8WqZ7Kz7EdPVeeQ3uXYKsjUCLJ:4O9qiASQBZ7KXEdPVTQeYKsjUCLJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hi13

Decoy

olidspot.shop
aise-your-voice.sbs
9ydygorig3l7z.xyz
netuzio.xyz
erspacehealthandwellness.info
hbnzk.cfd
uklor.shop
tudiofoti.pro
onety.skin
iralavinc.online
teelpath.shop
w-yudfjp.shop
betka.xyz
lx2cbhe5vee0e1.xyz
ndotoverf.pro
loud-sevice.click
enckubs.shop
anpack.shop
nity-3d-development.dev
iaolento12.sbs
xectgroup.net
avakey.shop
kfast.store
ayeewenvqzqm.top
66xq2.top
cvaultshielded.live
5zbm0.cfd
g1wszulqv7lc.xyz
rog.top
xplosion-proof.lat
aysec.net
999game.website
3a4p8gq8bojwn.xyz
x92q.top
akextow.net
t775.top
873013.xyz
tu1x120.top
9882aa1216.autos
ayarwarna21.live
ardengoal.net
8ln62.cfd
elvetvoiceskiresorts.website
kpqh.town
njjwh.info
movps.net
pb79kasy.vip
ellbar.shop
inktrim.xyz
hagrinleemotooltechus.shop
olayl
tp-batik77-1.vip
looring-services329769.sbs
130t.xyz
9gi02.cfd
elayrunway.shop
phones-br.sbs
aser-skin-treatment-95250.bond
ry-prodentims.shop
rtelegans.art
01411.club
it4n1ar4t0k7o0.xyz
igitalmilanolegacy.shop
ompanion.bio
gsp657.top

Targets

- Target
  VZXBSD.exe
- Size 224KB
- SHA256 896dacfb811fcde80b97bb497aa5abc2dc3bcdedae8c0791512b208aea6b65bf
- MD5 88bc69b054558e4f2dc95106a1c3e3a8
- SHA1 1a0a747e267376860c3e2e764188cd6ff7895a86
- SHA512 19c2a8601409e98d69faae1437c1caa4bb26ee708f205e332a85854cf14aa145e8689e21e6df4240eeb3a2ad929e273dff6d0cec55e50ecd1f5e51784aae3457
- SSDEEP 6144:/OTn2z/v8iDhDqiAS8rNsZ8WqZ7Kz7EdPVeeQ3uXYKsjUCLJ:4O9qiASQBZ7KXEdPVTQeYKsjUCLJ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook hi13 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2