formbook

General

Target
1f8097ccc932fecf1b0ba2997ac3ef35b5d99d2d58408a6a0b45131fcedfc599.exe
Size 619KB
Sample260205-trjd3adv6e
SHA256 1f8097ccc932fecf1b0ba2997ac3ef35b5d99d2d58408a6a0b45131fcedfc599
MD5 aa35917f9e2986db1105ea270882d267
SHA1 0ef9e9e113f8c9c18d956dd39a8d2d05194d8352
SHA512 9cb74137e1aa16d452dbaf4006b6b1a2cbbe5632adb7045a55adcfc7dce4e92bab7f97e28abdd889f8a6888308630655cd08321a6d26dbb634f82af4eb45959e
SSDEEP 12288:04nN/oHxmO8EKQyJTvq7qrEA7VVf7G16EHrx4F:LNAHQOrKQ0vYmVfrW+
TLSH
T1A4D4E11EB124448EF9114B3400F7A21FAD99EE94BE739A5F0337FC565B729112DC3AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  1f8097ccc932fecf1b0ba2997ac3ef35b5d99d2d58408a6a0b45131fcedfc599.exe
- Size 619KB
- SHA256 1f8097ccc932fecf1b0ba2997ac3ef35b5d99d2d58408a6a0b45131fcedfc599
- MD5 aa35917f9e2986db1105ea270882d267
- SHA1 0ef9e9e113f8c9c18d956dd39a8d2d05194d8352
- SHA512 9cb74137e1aa16d452dbaf4006b6b1a2cbbe5632adb7045a55adcfc7dce4e92bab7f97e28abdd889f8a6888308630655cd08321a6d26dbb634f82af4eb45959e
- SSDEEP 12288:04nN/oHxmO8EKQyJTvq7qrEA7VVf7G16EHrx4F:LNAHQOrKQ0vYmVfrW+
- TLSH
  T1A4D4E11EB124448EF9114B3400F7A21FAD99EE94BE739A5F0337FC565B729112DC3AA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery formbook rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
- MD5 9625d5b1754bc4ff29281d415d27a0fd
- SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
- SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
- SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
- TLSH
  T1BD325D06235081F3E1914138846B3E175F6A15069BF58E97DFD38646BE30BE7BD79503
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Formbook family

Formbook payload

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4