formbook

General

Target
21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86.exe
Size 1.0MB
Sample250610-lvl1csszet
SHA256 21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86
MD5 729879c904325aab4786b3d538e8168a
SHA1 e54f5963c6382d277d1cc76692691e96274c114e
SHA512 d6a66cff124a4600feaa7a7ee9d94ed68bb1b523ca892dc5c8551a21022cc7e6d01eba2d805df1fcba662868642640eb646dc822e65824ef81668658190e5c67
SSDEEP 12288:rtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaF7m2UrWPrDzmB7KCXt5:rtb20pkaCqT5TBWgNQ7aZmXaPSTt6A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dy23

Decoy

anguage-courses-48869.bond
967dhs23.top
kc7u5.top
qe9bz.vip
ucky-jet777-1.top
hopngoworld.net
bbgpower.xyz
31589.vip
ark-spots-removal-96358.bond
jwe.top
adiantexplorer822.shop
ad.llc
t6lvy.vip
arovinulexop.click
-lordserial82.top
tundst.xyz
321jwm.top
rkapex.homes
sviuwrhdejt.pro
om-etceow.vip
maingur.website
eoul-bestanma7.xyz
agaku88menang.xyz
eisehuixx106.top
efenseagency.pro
moja.coffee
eladann.pro
mx0h2.vip
win7.click
omesenior.shop
950701.xyz
eatsandals.top
utotraca.net
athroom-remodeling-18957.bond
mwcauk.xyz
es02i.vip
ibttb.top
bkaczw.website
heni.xyz
2jwe.top
ain-management-94044.bond
lzqod.vip
926a.top
otrepoker.net
alentinocontihome.shop
39cz.top
d6bow.cfd
lokiboop.xyz
bt1473.xyz
ires-93741.bond
p0xwy.vip
k4f2f.vip
yatt.pics
qazlu4bsc4.xyz
afangui.chat
hayanshi.top
bss1317.xyz
n315.top
ayezp.vip
hotohub.tech
jf8er.vip
stral-wisdomportal.click
no8q8.vip
eavenjoyful.shop
herapy-centers-47841.bond

Targets

- Target
  21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86.exe
- Size 1.0MB
- SHA256 21d3f57e61ce525123d11ca6da1dbfe05b9e95bdd5867309e38d59c4140f7d86
- MD5 729879c904325aab4786b3d538e8168a
- SHA1 e54f5963c6382d277d1cc76692691e96274c114e
- SHA512 d6a66cff124a4600feaa7a7ee9d94ed68bb1b523ca892dc5c8551a21022cc7e6d01eba2d805df1fcba662868642640eb646dc822e65824ef81668658190e5c67
- SSDEEP 12288:rtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaF7m2UrWPrDzmB7KCXt5:rtb20pkaCqT5TBWgNQ7aZmXaPSTt6A
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook dy23 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2