formbook | 4c8667cac2549c81c5d02267072efd8bf1dff0fe64858b55adc04a596e48910f

General

Target
order N° 25000474,.rar
Size 314KB
Sample260731-pl4qlattez
SHA256 4c8667cac2549c81c5d02267072efd8bf1dff0fe64858b55adc04a596e48910f
MD5 f437153c522e57ce9ecdb2eac80a6060
SHA1 4f366f5846b825aaa5503aa21171d4fe877e3112
SHA512 01f91b23c4f78893aaaa586f68b9b8950f2c255b87a9143a3ad137d09f53aed429fac6a992867f81313ffa8b649ada59f6705975dd7bdb2bb0d0fde3b1f8cbae
SSDEEP 6144:OLjpbxyqDSNGWkD8iBaLWoAIjs8eAcJe9ZPXF8F9x9v/:ikGP4iB2Wi5Gfx9v/
TLSH
T12464230923F5DC25AF7687CF890DE2960D47FCB561F89938AA4CE053182BF68421BD5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  order N° 25000474,.exe
- Size 349KB
- SHA256 868f688f5c9300df03eeda85f23885c504d35717ce5a3fde77d69f34e72b6b50
- MD5 4200ea00cb9c8382dbce6943f64e7127
- SHA1 a3b5f2e93023c6b46eb33cb5fbb86572aaf86805
- SHA512 7528586ad97a36fa63c1b116a3902a7b5e8584ab0b64e77291f5a1fbea4d91d7ce5a4e6e8927aeea834874a3b5ec981397529f53c4352e1f4f93d100185dd2e9
- SSDEEP 6144:L9X0GN6Bo9PMbSDWU0KMdusQEr7vHkgXaLktteIhbkFfAd4KYoQ6wSQIxpgXlcBZ:l0MOo9PM+vmTEgKLYeoASd4yQ6wRIYcb
- TLSH
  T19A74120236A1C467E55208B00B76AFF9DFF48E1070586B97F7A47E1E3D73AA2581E543
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery formbook rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
- MD5 34442e1e0c2870341df55e1b7b3cccdc
- SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
- SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
- SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
- TLSH
  T108326D5503504AF3E996863C00263B7FAF796A2095F14D53DFA394C0FE2E5C9AD78352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 e664756ea6bfb01787ee6dfe299f1e1cc52b0453759771124c9359cb3cf79cb4
- MD5 602d953c391a05d2be162a661962c598
- SHA1 794b83002517dca3a017337946d39df55646e3e0
- SHA512 f376662cb07cb5b5ca0e2261a810f2ddabe82843464857ecedf1413949492adbabaf5df73b77f9ab8dc8f59e960298ab6576c6f50622252368e4be4b587c7c2c
- SSDEEP 96:orDlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4b8qndYv0PLE:orp34z/x3sREskpxUdO0PLE
- TLSH
  T1131208135A4454B3C9E6223A31AA2F2ECB3C932490627D02C7779E1A2BB42167D3E352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Formbook

Formbook payload

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6