formbook | 8bda7db9909e9b4e6bbb325102bae2639f622cf3d895e1b500f7a02cfd21608d

General

Target
_8bda7db9909e9b4e6bbb325102bae2639f622cf3d895e1b500f7a02cfd21608d.exe
Size 176KB
Sample260623-kclffabs9p
SHA256 8bda7db9909e9b4e6bbb325102bae2639f622cf3d895e1b500f7a02cfd21608d
MD5 eaccbc831b2fc77bdcd8eb19f5f3dee1
SHA1 9f70c4d1ab267ffc886ca66f1d46e51b43c393a6
SHA512 c01691f06101c3e7e1e86fc8018636e42c9dc18a0ed336244f37821d6c2c0e1c7c17b60a5306c629532e8bca56535f694a00bd53771fca164d954bbe1022667d
SSDEEP 3072:blnffjVrwUak7uVPvA5fCDlS2wpjJYrQFCIikHOlSE5i/4xhQRZKXGfJI1ok:blnhrwtVPvOKDo2wjrTikHE5vxiKXGfU
TLSH
T12B04F15532A0C863D6E206701E765AF6EABF9D511594030B6F283FAB7D335B2810F793
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  _8bda7db9909e9b4e6bbb325102bae2639f622cf3d895e1b500f7a02cfd21608d.exe
- Size 176KB
- SHA256 8bda7db9909e9b4e6bbb325102bae2639f622cf3d895e1b500f7a02cfd21608d
- MD5 eaccbc831b2fc77bdcd8eb19f5f3dee1
- SHA1 9f70c4d1ab267ffc886ca66f1d46e51b43c393a6
- SHA512 c01691f06101c3e7e1e86fc8018636e42c9dc18a0ed336244f37821d6c2c0e1c7c17b60a5306c629532e8bca56535f694a00bd53771fca164d954bbe1022667d
- SSDEEP 3072:blnffjVrwUak7uVPvA5fCDlS2wpjJYrQFCIikHOlSE5i/4xhQRZKXGfJI1ok:blnhrwtVPvOKDo2wjrTikHE5vxiKXGfU
- TLSH
  T12B04F15532A0C863D6E206701E765AF6EABF9D511594030B6F283FAB7D335B2810F793
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery formbook rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Formbook

Formbook payload

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4