formbook

Sharing

Copy URL Twitter E-mail

General

Target
b032278d8d40cb761a9f56ea0438656d722e67562f053edcf24c9fb54c6bad8b.exe
Size 934KB
Sample251009-t53pvsgp9v
SHA256 b032278d8d40cb761a9f56ea0438656d722e67562f053edcf24c9fb54c6bad8b
MD5 944f40d5c477f657d634bdceaf9941fc
SHA1 dbb971e5cf196790b0adf0f3ca25f72c586a1a20
SHA512 fed5775c9aca46fa2518078ba113d49b74016bfbfc69caa51f4bbe15bb183b27d82de8e379dca407f27fa604ba8dd362fa13fd91cfd77b008b28beeaca4807bb
SSDEEP 24576:7kaMrUZcTyhdkcdR4jvbKc0OkhdaWwAWawBJ5Y5NHQ/UBcdTx:YnUZsyhdkcA/05RluBJ52NH+hx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  b032278d8d40cb761a9f56ea0438656d722e67562f053edcf24c9fb54c6bad8b.exe
- Size 934KB
- SHA256 b032278d8d40cb761a9f56ea0438656d722e67562f053edcf24c9fb54c6bad8b
- MD5 944f40d5c477f657d634bdceaf9941fc
- SHA1 dbb971e5cf196790b0adf0f3ca25f72c586a1a20
- SHA512 fed5775c9aca46fa2518078ba113d49b74016bfbfc69caa51f4bbe15bb183b27d82de8e379dca407f27fa604ba8dd362fa13fd91cfd77b008b28beeaca4807bb
- SSDEEP 24576:7kaMrUZcTyhdkcdR4jvbKc0OkhdaWwAWawBJ5Y5NHQ/UBcdTx:YnUZsyhdkcA/05RluBJ52NH+hx
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery execution formbook installer rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
- MD5 81e268e27dbbcadbf116b5a9402195ab
- SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
- SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
- SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 7853be9190489ba84dae8232e9a967cec02d941732cb4137bc9ae6a392e89fb8
- MD5 3fbd78c889fa40a2e5567b980c57b7db
- SHA1 303564bfa6fd5ab7a65d35ae1cd14a05643b6b5d
- SHA512 95ccd599cdacb1128aa35694aa5428f12f50a20d95bb500e9b180b3ab322b1870ae301f77f7ca0e8674c78742a1eb5c82ba3cee05c67d3d961a695563c8c1514
- SSDEEP 96:oX7lf7AR1VhrfzBik0cxM2DjDf3GEkniJnifvcx418qndYv0PLE:oXl7wrLBn0REc0JxedO0PLE
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 e20666c498941d36bfd0eae411ad73c475d043cee39b50c31734a70eecaae0bb
- MD5 13bd8e89dc79004d85ab02626e08c3c5
- SHA1 0ef0efb3237233de26f55c4420753ed0fed418ad
- SHA512 58841cc9e8313775a097a93e68952d8005b826bf1349dc24d49e3128b87e9021a028d2d4e738997390f1625f7ae7744a9ff85289f6c78f5ebd67c0da61ef2120
- SSDEEP 96:pOBtYZKtPsrqBApt1JHpb9XWk7Qe06iE6mE6YNFyVOHd0+uUwEX:ptZKtrAJJJbP7iEHEbN8Ved0Pw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Basisordenes.Spa
- Size 56KB
- SHA256 71e57f230db4bb52d5a7bb3fc17b10f9b785a1ac02236dc1ef84d30b162a83a6
- MD5 f62446d7d30f6411147da33721f9e7c6
- SHA1 b3ca146acbd453850008bc7d02ffdab67d836f56
- SHA512 a98477d48fb500511d151ffbbb0b268e3871df99760423f5aeea3805868cc29c284fa4018f193ced7691f9fe3c1248ce6db38ea27168e1afe47b0b7667291e88
- SSDEEP 384:4Kji/T4jWJK2tqvgpdzCo1ommOdsFssEbKnCFMme:41hAYDhdsFs/Ro
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9