formbook

General

Target
Payment_advic_0097766886.pif.exe
Size 830KB
Sample250910-p36arayqs9
SHA256 e1f4bf968e975bdb45e48107ef68200d53e96ee2598b44e1f424ab7e298b4e52
MD5 c55941da9a8d5d4b58c5712509d76147
SHA1 396335ee2795ebecde9a8abf439ab7dc44c8c932
SHA512 03a073ea7bc7bafedb3d152f59ae686393670f9a72ba51d6ccc4afef2c93b67d67e85a0fd83c6e9fb5715de164154b6e2d97b1e1ec4f27052c0c8589e64d6ff6
SSDEEP 12288:hkd4FvdddddcSxetUZ9zET7Rv6YnK8WK1efPKMggh8G52lOGpCZNQYsCEk4yqDLF:huuQXrCP98G5AwQYsCOyqDsnQZy2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ol06

Decoy

btt.app
7648419.vip
euenviiodiigiital.shop
entry.sbs
eroysane.xyz
k2y7bcw.xyz
elcuksozluk.xyz
00hu05.shop
ork-law-9s10s5.live
niquetouchsweets.shop
orklift-jobs-78023.bond
c3974.top
ormiimpal.pro
learnotion.xyz
pcj.net
arinsoft.net
z23.top
vmdia7.xyz
iyabet.xyz
ujitegemea.net
ummervibezonly.shop
rabuslot777win.xyz
tzay.realtor
eil.pro
g299.top
4615.net
ikilo.shop
6237871.vip
ental-implants-22908.bond
mfdoc.cfd
etlemonlightapp.click
ristinvaneetvelt.shop
esale-server.shop
erchantiindustry.net
tlantida-sh.cloud
ldgfq.top
c2507.top
btzk.club
raedenwhitten.vip
4047.club
smaticoferoz.win
ikmomk.shop
uynta.cloud
us230.top
uartzxenialpingrun.christmas
uritdinismailov.shop
athanielross.shop
pple-podcast-connect.cfd
xbet-ajpr.top
ndiana.vote
rsmdr.top
fhomesolutions.net
orenewullc.net
h8klb.top
816hd1.vip
4742.club
alishka.club
ostbet-4ff8.buzz
gpi185.top
ri6hw.click
stiar.xyz
dbookstore-1.shop
oinpurple.live
ulta.city
c0571.top

Targets

- Target
  Payment_advic_0097766886.pif.exe
- Size 830KB
- SHA256 e1f4bf968e975bdb45e48107ef68200d53e96ee2598b44e1f424ab7e298b4e52
- MD5 c55941da9a8d5d4b58c5712509d76147
- SHA1 396335ee2795ebecde9a8abf439ab7dc44c8c932
- SHA512 03a073ea7bc7bafedb3d152f59ae686393670f9a72ba51d6ccc4afef2c93b67d67e85a0fd83c6e9fb5715de164154b6e2d97b1e1ec4f27052c0c8589e64d6ff6
- SSDEEP 12288:hkd4FvdddddcSxetUZ9zET7Rv6YnK8WK1efPKMggh8G52lOGpCZNQYsCEk4yqDLF:huuQXrCP98G5AwQYsCOyqDsnQZy2
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ol06 discovery formbook rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2