formbook

General

Target
dc19c97f006376ebb5a3173aa30104a98f3abef2ee5787df69898afd37883e20.exe
Size 326KB
Sample260306-sgsdjsa17y
SHA256 dc19c97f006376ebb5a3173aa30104a98f3abef2ee5787df69898afd37883e20
MD5 3128bb11f7a8ba1f45002ce82d5ca40a
SHA1 b760ed6dc2100f11f58ffad17cdfb824ebd5eacb
SHA512 994d6b0fc4d0412ee9f81b8910303f0c2e3a0b07c2a6af230d6d6f4f488cfcf022dc3744f12164174f3be9fc26351399278d67a57ce318a33e37dfad9e5c361e
SSDEEP 6144:JnPdudwDOpoJJsE7lldBUQptJl4hSxiLCmjSZmdkEAe+/WXj4YkBkDZFZNWQd:JnPdipovL1l78+muyRc1OD/X
TLSH
T17F641210B6D6CD25D9C60B704A3646F1EEEBAD924098974F6F407FAB7C31A71A80E743
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  dc19c97f006376ebb5a3173aa30104a98f3abef2ee5787df69898afd37883e20.exe
- Size 326KB
- SHA256 dc19c97f006376ebb5a3173aa30104a98f3abef2ee5787df69898afd37883e20
- MD5 3128bb11f7a8ba1f45002ce82d5ca40a
- SHA1 b760ed6dc2100f11f58ffad17cdfb824ebd5eacb
- SHA512 994d6b0fc4d0412ee9f81b8910303f0c2e3a0b07c2a6af230d6d6f4f488cfcf022dc3744f12164174f3be9fc26351399278d67a57ce318a33e37dfad9e5c361e
- SSDEEP 6144:JnPdudwDOpoJJsE7lldBUQptJl4hSxiLCmjSZmdkEAe+/WXj4YkBkDZFZNWQd:JnPdipovL1l78+muyRc1OD/X
- TLSH
  T17F641210B6D6CD25D9C60B704A3646F1EEEBAD924098974F6F407FAB7C31A71A80E743
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader formbook guloader rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Formbook payload
  rat
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- TLSH
  T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Formbook family

Guloader family

Guloader,Cloudeye

Formbook payload

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4