formbook | 9b1b95c4aacfc7ac8dd3300424eab82dbc599cd2bc219ca5b2964cf2815805d5

General

Target
9b1b95c4aacfc7ac8dd3300424eab82dbc599cd2bc219ca5b2964cf2815805d5.exe
Size 310KB
Sample260810-sp3jgscj3t
SHA256 9b1b95c4aacfc7ac8dd3300424eab82dbc599cd2bc219ca5b2964cf2815805d5
MD5 aa6570c00f4d39c1580e5772bd8c6cbc
SHA1 e4d9df5f01a47c816ad140661024487161ea3b1a
SHA512 e78ff7b769d4a5727e679ac5259112342972cc0c5ad5c66524be0ed866d9881bdee029820f0ffdb0f4fa9671f482a7c31527a696938df08fe7310ff7ebbd2d2f
SSDEEP 6144:M9X0GN6Bo9PMbSDWUOKMRaEUrEjwT2Eryemwrv7zdFx0GYVpm6iNn:C0MOo9PM+vxEMGwT2EfVdvRdn
TLSH
T14064121727B1D81EDA4B19F08C7AEB7D5FB14F0060A6470BDB20BA4E3D73565292E683
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  9b1b95c4aacfc7ac8dd3300424eab82dbc599cd2bc219ca5b2964cf2815805d5.exe
- Size 310KB
- SHA256 9b1b95c4aacfc7ac8dd3300424eab82dbc599cd2bc219ca5b2964cf2815805d5
- MD5 aa6570c00f4d39c1580e5772bd8c6cbc
- SHA1 e4d9df5f01a47c816ad140661024487161ea3b1a
- SHA512 e78ff7b769d4a5727e679ac5259112342972cc0c5ad5c66524be0ed866d9881bdee029820f0ffdb0f4fa9671f482a7c31527a696938df08fe7310ff7ebbd2d2f
- SSDEEP 6144:M9X0GN6Bo9PMbSDWUOKMRaEUrEjwT2Eryemwrv7zdFx0GYVpm6iNn:C0MOo9PM+vxEMGwT2EfVdvRdn
- TLSH
  T14064121727B1D81EDA4B19F08C7AEB7D5FB14F0060A6470BDB20BA4E3D73565292E683
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery formbook rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
- MD5 34442e1e0c2870341df55e1b7b3cccdc
- SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
- SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
- SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
- TLSH
  T108326D5503504AF3E996863C00263B7FAF796A2095F14D53DFA394C0FE2E5C9AD78352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 e664756ea6bfb01787ee6dfe299f1e1cc52b0453759771124c9359cb3cf79cb4
- MD5 602d953c391a05d2be162a661962c598
- SHA1 794b83002517dca3a017337946d39df55646e3e0
- SHA512 f376662cb07cb5b5ca0e2261a810f2ddabe82843464857ecedf1413949492adbabaf5df73b77f9ab8dc8f59e960298ab6576c6f50622252368e4be4b587c7c2c
- SSDEEP 96:orDlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4b8qndYv0PLE:orp34z/x3sREskpxUdO0PLE
- TLSH
  T1131208135A4454B3C9E6223A31AA2F2ECB3C932490627D02C7779E1A2BB42167D3E352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Formbook

Formbook payload

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6