formbook | 0035d9424bdee5b512bd3441db4be0486f82a7beb8890713dada7d83e3b7b845 | Triage™

Login
Reports

Overview

overview

Static

static

3

RFQ-010-PS...S).exe

windows10-2004-x64

RFQ-010-PS...S).exe

windows11-21h2-x64

Sharing

Copy URL Twitter E-mail

General

Target
RFQ-010-PS(WhatsApp-IMGS).exe
Size 1.4MB
Sample260413-jmbtbae14p
SHA256 0035d9424bdee5b512bd3441db4be0486f82a7beb8890713dada7d83e3b7b845
MD5 1ad4327222eebe7eddafbfab5030b795
SHA1 871ddfa22851384a731a04fcf34cec2afea8e50f
SHA512 f1d17fdbc5b7a8f766939d2a63aec0488c951d8227fe20952f50a29dd89d356f2ca669a89918d3dc2f173fa00ed411856f80de453a4351f7e19645fe7656828b
SSDEEP 12288:Ts99qwhbgk/LCs8upCiFPlb3saUvrs2gGn0BIxS18f/tpraF32W6LSueA2fEMgSk:o99X7t88Ci1l7svrsEoOf/raklxV2CR
TLSH
T18965E01B6E56E836D375467F48A0E0780BB82C1995D2E1077ECEFA9B7C39F424A85343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

formbook discovery rat spyware stealer trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

RFQ-010-PS(WhatsApp-IMGS).exe

Resource

win10v2004-20260130-en

windows10-2004-x64

7 signatures

150 seconds

discovery formbook rat spyware stealer trojan

Behavioral task

behavioral2

Sample

RFQ-010-PS(WhatsApp-IMGS).exe

Resource

win11-20260130-en

windows11-21h2-x64

7 signatures

150 seconds

discovery formbook rat spyware stealer trojan

Malware Config

Targets

- Target
  RFQ-010-PS(WhatsApp-IMGS).exe
- Size 1.4MB
- SHA256 0035d9424bdee5b512bd3441db4be0486f82a7beb8890713dada7d83e3b7b845
- MD5 1ad4327222eebe7eddafbfab5030b795
- SHA1 871ddfa22851384a731a04fcf34cec2afea8e50f
- SHA512 f1d17fdbc5b7a8f766939d2a63aec0488c951d8227fe20952f50a29dd89d356f2ca669a89918d3dc2f173fa00ed411856f80de453a4351f7e19645fe7656828b
- SSDEEP 12288:Ts99qwhbgk/LCs8upCiFPlb3saUvrs2gGn0BIxS18f/tpraF32W6LSueA2fEMgSk:o99X7t88Ci1l7svrsEoOf/raklxV2CR
- TLSH
  T18965E01B6E56E836D375467F48A0E0780BB82C1995D2E1077ECEFA9B7C39F424A85343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery formbook rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryformbookratspywarestealertrojan

behavioral2

discoveryformbookratspywarestealertrojan

© 2018-2026

Terms | Privacy