formbook | 83697bd08a9844ba1f10dbad153b6ae13aa7915f62e5a30d75a5fd7136324b8b

General

Target
Fattura proforma PDF.rar
Size 996KB
Sample260724-lsavbabq4s
SHA256 83697bd08a9844ba1f10dbad153b6ae13aa7915f62e5a30d75a5fd7136324b8b
MD5 fa807d59e47b6ed56d0b259d61d999be
SHA1 ae36690bdfdaffee4fb230c336dcde3b2e25469b
SHA512 c9d1fe00c6c39add1e722369cb1fd7e33c0da3c7f523b8daa7818c47df0c52ae59d843e9c24d8dd2fbd394716ccc0393427b15a03ebb34a4268f37f343a27480
SSDEEP 24576:r3wFB8xvOTOxl5GR+DGV/v2rfp+A5f79VuhcUWG8Vy6wYksCrj:r3wFBILv5GR+DAnSpVx79VW3W93nIj
TLSH
T1DE253340D1CA0ABF4EFB0BD7ACD923E7D7561A366DF3624F458C989F2041292424BBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Fattura proforma PDF.rar
- Size 996KB
- SHA256 83697bd08a9844ba1f10dbad153b6ae13aa7915f62e5a30d75a5fd7136324b8b
- MD5 fa807d59e47b6ed56d0b259d61d999be
- SHA1 ae36690bdfdaffee4fb230c336dcde3b2e25469b
- SHA512 c9d1fe00c6c39add1e722369cb1fd7e33c0da3c7f523b8daa7818c47df0c52ae59d843e9c24d8dd2fbd394716ccc0393427b15a03ebb34a4268f37f343a27480
- SSDEEP 24576:r3wFB8xvOTOxl5GR+DGV/v2rfp+A5f79VuhcUWG8Vy6wYksCrj:r3wFBILv5GR+DAnSpVx79VW3W93nIj
- TLSH
  T1DE253340D1CA0ABF4EFB0BD7ACD923E7D7561A366DF3624F458C989F2041292424BBD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware collection discovery formbook rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Fattura proforma PDF.exe
- Size 1.1MB
- SHA256 7cf341abc47c1aff8deccb0f1689e21d98b29218f25540eba47af269e569f1cb
- MD5 7059eb13b5798a72f35203d289c56ffe
- SHA1 15f7508ea488267a2edaba32bc347087da87adce
- SHA512 3db049f72f39a56246bf88768774669954a08ca55ff782a99252affc2901aafd4d0245212662c0c45218a04d0cecffe5eb2b8fa9bb6f38616ac3114154596477
- SSDEEP 24576:cp50m34Zh+YBwH+xgAOg80DlHnWttRC1jBlTM:cpf4Zh3BwHrsVnWnRC1jw
- TLSH
  T1F63501541316EE42D0DA8BB2BDB1D33432B90DDF78E2C2925FE56FF778193812958682
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery formbook rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Formbook

Formbook payload

Executes dropped EXE

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Family: Formbook

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4