formbook | f781b5d424d7d0357605e24fce42cbcfa1031e7b9a718e8c834b5cd6fb40229e

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_206a55a379da8ef511f29fe50dca4686_agent-tesla_darkgate_elex_hawkeye_maze_remcos
Size 1.1MB
Sample260809-gggq9sha25
SHA256 f781b5d424d7d0357605e24fce42cbcfa1031e7b9a718e8c834b5cd6fb40229e
MD5 206a55a379da8ef511f29fe50dca4686
SHA1 7634f81a0e11a548e6a7e0d95879c312f737cc46
SHA512 3d3a04e62f19a568ca9ceab1449ecb461cf0e1bfad271ef23df67f71956c950228da4bf15c0dbaa291754e7c1114b6cd5742ed01e272c74de1364d68d36ad4b0
SSDEEP 24576:hCdxte/80jYLT3U1jfsWa6SMIo9noji+83Q:Aw80cTsjkWaRM5Gjic
TLSH
T19945DF2273DDC361CB669173BF59B3017EBF7C650630B85B2F881D79A960171222DAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

formbook nh discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

Decoy

satishgadhave.com
odessian.solutions
liveseesexywomenpics.com
uretenzihinler.info
wasgeht.party
sunswepttravels.com
nirmityclayz.com
murockstarserver.net
lightscore.ltd
laurenhinley.com
ngozc.info
indiansexysex.com
salemd.com
valentina-furs.com
hydrabadbiriyanicoimbatore.com
connectsetup.com
castellonear.com
benelos.com
libreria9.com
infinityea.net
itscoreykpa.com
dominocomplex.win
scotchandsippycups.com
mcas-test9.com
chiapassevive.com
ugtsz.com
kanittha.com
fulhdmovie.cymru
epjseqtx.com
tv16771.info
nhavuonhoanganh.com
madeinitalfood.com
upravdom.group
institut-intuition.com
petfriendlyrentals.net
thebuyincompany.com
vevapelo.com
kabieokie.com
lubb21211.com
kingagroup.com
stsjthisweek.com
empeclesi.com
modwrk.com
marmido.com
mypropertyny.com
theloken.com
sendbittec.com
rayilu.com
cheapqueendream.com
januarymountain.com
patrioticintegration.online
joneybn.com
qdeduask.com
chansoku.com
xn--q20bq4u8xgu3awin9m.com
cuicongnghiep.com
rotherstoneaccounting.co.uk
softoemdownloadfastg.technology
hartaideal.com
oncoreskateandsnow.com
hargawaterstop.com
alanotaryatlarge.com
reactwindow.com
tyjds.info
clevorayp.com

Targets

- Target
  2026-08-09_206a55a379da8ef511f29fe50dca4686_agent-tesla_darkgate_elex_hawkeye_maze_remcos
- Size 1.1MB
- SHA256 f781b5d424d7d0357605e24fce42cbcfa1031e7b9a718e8c834b5cd6fb40229e
- MD5 206a55a379da8ef511f29fe50dca4686
- SHA1 7634f81a0e11a548e6a7e0d95879c312f737cc46
- SHA512 3d3a04e62f19a568ca9ceab1449ecb461cf0e1bfad271ef23df67f71956c950228da4bf15c0dbaa291754e7c1114b6cd5742ed01e272c74de1364d68d36ad4b0
- SSDEEP 24576:hCdxte/80jYLT3U1jfsWa6SMIo9noji+83Q:Aw80cTsjkWaRM5Gjic
- TLSH
  T19945DF2273DDC361CB669173BF59B3017EBF7C650630B85B2F881D79A960171222DAA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

nh discovery formbook rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Formbook

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2