formbook

General

Target
Sample photos and drawings.vbs
Size 2.1MB
Sample251104-k1xtdaaz5e
SHA256 48397dd0a53c9306920e12fae76d6527c8c64746b2932ec0b652bf7319f6a33d
MD5 64d78b9a8a72ab0ad6d474ae40bcd7da
SHA1 f6e9fb5172fa82a9ae07ede9deb114f39bb2b772
SHA512 42ff9c84321af1d9252c320f2c7553d710bb76482fe291b7e1bb6bf4ee39408b13747fa030ddd877ef346e71ccf57272c08312ae0c2e7d611b084b17b822a467
SSDEEP 24576:5uggkV4Oo4oAQTGn3Rj8RQd6wrojHnwy6XyBRB+gUVUu7us9EEowGU2PY3XvbDQU:Ng2o4o9+RAR+lr5X2CPOTxDG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Sample photos and drawings.vbs
- Size 2.1MB
- SHA256 48397dd0a53c9306920e12fae76d6527c8c64746b2932ec0b652bf7319f6a33d
- MD5 64d78b9a8a72ab0ad6d474ae40bcd7da
- SHA1 f6e9fb5172fa82a9ae07ede9deb114f39bb2b772
- SHA512 42ff9c84321af1d9252c320f2c7553d710bb76482fe291b7e1bb6bf4ee39408b13747fa030ddd877ef346e71ccf57272c08312ae0c2e7d611b084b17b822a467
- SSDEEP 24576:5uggkV4Oo4oAQTGn3Rj8RQd6wrojHnwy6XyBRB+gUVUu7us9EEowGU2PY3XvbDQU:Ng2o4o9+RAR+lr5X2CPOTxDG
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery formbook modiloader rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- Formbook payload
  rat
- ModiLoader Second Stage
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Formbook family

ModiLoader, DBatLoader

Modiloader family

Formbook payload

ModiLoader Second Stage

Checks computer location settings

Executes dropped EXE

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2