formbook

General

Target
ARRIVAL-NOTICE-pdf.exe
Size 572KB
Sample260108-keytjses4e
SHA256 a2872a57bbad4ddbd5a46e2bd32d502b0f8e0682d89869b72613d5bd5f74b580
MD5 9e85094d5adc576149b0b61728eb1b1c
SHA1 8b9af34bb7e19078f1f05ea4481194791727944d
SHA512 1bb5909d77f822476c802c88377aaebfaef50569a1c5deb7035ccef591113b6b05735f777a070532e4798c291b4f10dbbe99354fad4fa772b3ef03d566eaae53
SSDEEP 12288:WbjSjfsuPH0JjaIsNULtE5oK9PMaYQ9WN09z:WbOjfJPH0Juh6GKK9mQ9ya
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  ARRIVAL-NOTICE-pdf.exe
- Size 572KB
- SHA256 a2872a57bbad4ddbd5a46e2bd32d502b0f8e0682d89869b72613d5bd5f74b580
- MD5 9e85094d5adc576149b0b61728eb1b1c
- SHA1 8b9af34bb7e19078f1f05ea4481194791727944d
- SHA512 1bb5909d77f822476c802c88377aaebfaef50569a1c5deb7035ccef591113b6b05735f777a070532e4798c291b4f10dbbe99354fad4fa772b3ef03d566eaae53
- SSDEEP 12288:WbjSjfsuPH0JjaIsNULtE5oK9PMaYQ9WN09z:WbOjfJPH0Juh6GKK9mQ9ya
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery formbook rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Formbook family

Formbook payload

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4