formbook | 600d4f1ca00a93e7e684c9b7efa436f09ef7f8edab035a9a7d06b2519fc1e0c1

General

Target
600d4f1ca00a93e7e684c9b7efa436f09ef7f8edab035a9a7d06b2519fc1e0c1.exe
Size 169KB
Sample260727-gmkecahn2w
SHA256 600d4f1ca00a93e7e684c9b7efa436f09ef7f8edab035a9a7d06b2519fc1e0c1
MD5 d3361c4dc0fe16054902f8dbd23a2332
SHA1 ba8065c9a5f88892fa9c80b267ea93ed7982d7ef
SHA512 9bb2377a65b5eee7ae6112ffb13b2e4868cb6da405c92f9f617e1b0526717e1a7a2661b0228eb00897c7284711b96f60dcac1f41e4ecc74190e69e90f934b7ab
SSDEEP 3072:buL3hi8lMcxV66ziJR5dA6TIziPrT6PM6ErqjJTtQ2fQtBtLtV:b0hv5V6fRA6TI+yPt+qjw2fKjV
TLSH
T18704E0A57150C877C4D206B018BA82F5DBB79E981061EB432F513E9FBC36AB6D91F243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  600d4f1ca00a93e7e684c9b7efa436f09ef7f8edab035a9a7d06b2519fc1e0c1.exe
- Size 169KB
- SHA256 600d4f1ca00a93e7e684c9b7efa436f09ef7f8edab035a9a7d06b2519fc1e0c1
- MD5 d3361c4dc0fe16054902f8dbd23a2332
- SHA1 ba8065c9a5f88892fa9c80b267ea93ed7982d7ef
- SHA512 9bb2377a65b5eee7ae6112ffb13b2e4868cb6da405c92f9f617e1b0526717e1a7a2661b0228eb00897c7284711b96f60dcac1f41e4ecc74190e69e90f934b7ab
- SSDEEP 3072:buL3hi8lMcxV66ziJR5dA6TIziPrT6PM6ErqjJTtQ2fQtBtLtV:b0hv5V6fRA6TI+yPt+qjw2fKjV
- TLSH
  T18704E0A57150C877C4D206B018BA82F5DBB79E981061EB432F513E9FBC36AB6D91F243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader formbook guloader rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Formbook payload
  rat
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 381ce74fe2c93bd7f31faeb05bd223b25354a03b6ac3098145f5a943272c4c02
- MD5 f3fdb8089ad2271be558053c4f69f0bd
- SHA1 28656faf1d3679f8669938cf0be4735109ccad92
- SHA512 beea156cb0b8d713d4d1ac497c79fb619ec97ffcb86762c3491175fae8681834dc7a5a281885471d5a4a8483bc731c9864b5db389e1aef02d6d4cb259411c5c5
- SSDEEP 192:ZFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/W93:R7pJp48F2exrg5F/W
- TLSH
  T106424B1583618EF2F5961E3C00667E2F2B79BE3416F140A39FE34481A99A1CF99B5392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Formbook

Family: Guloader,Cloudeye

Formbook payload

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4