formbook | 0cc87edf5dd17fe02cb5fa8925087374dde0f3a2de206f726f2c98d2f193f6c3

General

Target
0cc87edf5dd17fe02cb5fa8925087374dde0f3a2de206f726f2c98d2f193f6c3.exe
Size 340KB
Sample260831-halmbayvfy
SHA256 0cc87edf5dd17fe02cb5fa8925087374dde0f3a2de206f726f2c98d2f193f6c3
MD5 7537d649c3ec62d6de4f4397639abe9d
SHA1 9cbe5798ca562db8bd9bb63edd11ddb1d1e637f6
SHA512 d58100050d57db6e1a9a1bfbb7055ee86f28cc817692bb2f9304854f3f7efe22267b68288613a2fda07ef93a58b4c4a6f370c522ca4edbf200ef5f249e4a16dc
SSDEEP 6144:W9X0GN6Bo9PMbSDWUtnKMD6PEvM0xGhJmN+7qjFVIeJGbAu0+1D0GeablKAYQfN6:Y0MOo9PM+vtA9UfNez1feabcR86
TLSH
T1457412092BA0D0A7CC1A0A728CF2AE765FF44E10605643075788BB7F7D637D6B62E647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  0cc87edf5dd17fe02cb5fa8925087374dde0f3a2de206f726f2c98d2f193f6c3.exe
- Size 340KB
- SHA256 0cc87edf5dd17fe02cb5fa8925087374dde0f3a2de206f726f2c98d2f193f6c3
- MD5 7537d649c3ec62d6de4f4397639abe9d
- SHA1 9cbe5798ca562db8bd9bb63edd11ddb1d1e637f6
- SHA512 d58100050d57db6e1a9a1bfbb7055ee86f28cc817692bb2f9304854f3f7efe22267b68288613a2fda07ef93a58b4c4a6f370c522ca4edbf200ef5f249e4a16dc
- SSDEEP 6144:W9X0GN6Bo9PMbSDWUtnKMD6PEvM0xGhJmN+7qjFVIeJGbAu0+1D0GeablKAYQfN6:Y0MOo9PM+vtA9UfNez1feabcR86
- TLSH
  T1457412092BA0D0A7CC1A0A728CF2AE765FF44E10605643075788BB7F7D637D6B62E647
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery downloader formbook guloader rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Family: Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Formbook payload
  rat
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
- MD5 34442e1e0c2870341df55e1b7b3cccdc
- SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
- SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
- SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
- TLSH
  T108326D5503504AF3E996863C00263B7FAF796A2095F14D53DFA394C0FE2E5C9AD78352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 e664756ea6bfb01787ee6dfe299f1e1cc52b0453759771124c9359cb3cf79cb4
- MD5 602d953c391a05d2be162a661962c598
- SHA1 794b83002517dca3a017337946d39df55646e3e0
- SHA512 f376662cb07cb5b5ca0e2261a810f2ddabe82843464857ecedf1413949492adbabaf5df73b77f9ab8dc8f59e960298ab6576c6f50622252368e4be4b587c7c2c
- SSDEEP 96:orDlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4b8qndYv0PLE:orp34z/x3sREskpxUdO0PLE
- TLSH
  T1131208135A4454B3C9E6223A31AA2F2ECB3C932490627D02C7779E1A2BB42167D3E352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Formbook

Family: Guloader,Cloudeye

Formbook payload

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6