formbook

General

Target
SWIFT_75,000EURO.exe
Size 585KB
Sample251009-e71kysywfw
SHA256 412a097d36135d1c09ef2e81f3fac61e43037670822ff0ddea3a553bb81d0f8f
MD5 762f00a6463f238696b22ddd004d40d8
SHA1 1612e486bdf2d45e41dc616208163947247e436c
SHA512 fe4a5f2c4ab76dd92eb7b761d0e67dd8ccbfe52edd9c5037751a14a986bdda8e543967caf8339967eb61d665678d809b0954972efff38596db9521fbdda6c9df
SSDEEP 12288:j7k4rDU/F4aJmGwHGUqY8xRHxE2KOf/yWMW/82koS6sEiFGOxFuaDcN:U4mmGwHjl8z7f/yWMW/N8REBa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sg36

Decoy

iwo7n.top
teluge.top
usman.vip
badan-drc-tusabv.info
aabodl.vip
luecap.xyz
c3024.top
oreaimoremoney.net
ushattention.tokyo
vcxb.xyz
esr.dev
aytime-sleepiness-79553.bond
ardrop.dev
y55ut8.pro
ling-it-up.xyz
ostepnosc.net
ebt-management.sbs
rkada4608.buzz
aquishaportfolio.net
onin69slot.net
badiahmuriithiwachira.cfd
o55bm.top
igtech.net
gileplanner.cloud
ineflaire.shop
upvwp.top
7cq.net
hidingllc.shop
g51-lzal1646.vip
refabricated-homes-22120.bond
oastwithjam.net
wcer.top
etablr.click
2675.click
nything-foo.bar
etivaeqiuq.pro
c1723.top
remation-services-51778.bond
layworld-club.xyz
zsjelmqkruv.xyz
herice.tech
ocsimples.top
7sfb5.top
ellygardner.shop
arsity-tutors.cfd
tormi.net
34a.vip
quqwb.top
ffshoreexecshub.shop
luprintpros.net
b177.top
accu.net
opycatinkteam.click
eamglobaltalenthub.shop
u7xgk.top
8644.club
yudn.shop
c1045.top
ura.shop
etmoonbuggy.click
ass.lat
hinecrest.shop
24-va9q13.rest
e520.net
ome-pest-control-9evich.zone

Targets

- Target
  SWIFT_75,000EURO.exe
- Size 585KB
- SHA256 412a097d36135d1c09ef2e81f3fac61e43037670822ff0ddea3a553bb81d0f8f
- MD5 762f00a6463f238696b22ddd004d40d8
- SHA1 1612e486bdf2d45e41dc616208163947247e436c
- SHA512 fe4a5f2c4ab76dd92eb7b761d0e67dd8ccbfe52edd9c5037751a14a986bdda8e543967caf8339967eb61d665678d809b0954972efff38596db9521fbdda6c9df
- SSDEEP 12288:j7k4rDU/F4aJmGwHGUqY8xRHxE2KOf/yWMW/82koS6sEiFGOxFuaDcN:U4mmGwHjl8z7f/yWMW/N8REBa
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

sg36 discovery formbook rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2