formbook | a46ba5efdf205586e586f63419d3ac7e26bf5904f7ce9a1430c12e546809662c

General

Target
SWIFT 0000XXXX12 EURO DOO BEOGRAD.zip
Size 946KB
Sample261002-lftrnatard
SHA256 a46ba5efdf205586e586f63419d3ac7e26bf5904f7ce9a1430c12e546809662c
MD5 861e8366a1e3bfa02d9ef8d2320b3621
SHA1 31b25613b4b61c82ce2785618eb625ad60533b53
SHA512 71c6f1b4b21cd08bdc5fdfe71a178fc1a6f52686b9d016b009aabedf2dc885c4ae0b8830d72cfcc2d01fe6a645152f478ca7b12135df75dcdb5e9fd277403c57
SSDEEP 12288:Kphi6IsIEYno7UEwv0lUxrefoXSS9h55iAc2EinGI4pIF+xsAt9T/Hgjz0xfUNb+:K3iPhWZjvf49cAcTUGIFU5HCPFQf
TLSH
T169253344890CFB4FD08AC582DCB1AA4D22BCD7E9D309593F6FB2C9D37984587523EA49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  SWIFT 0000XXXX12 EURO DOO BEOGRAD.zip
- Size 946KB
- SHA256 a46ba5efdf205586e586f63419d3ac7e26bf5904f7ce9a1430c12e546809662c
- MD5 861e8366a1e3bfa02d9ef8d2320b3621
- SHA1 31b25613b4b61c82ce2785618eb625ad60533b53
- SHA512 71c6f1b4b21cd08bdc5fdfe71a178fc1a6f52686b9d016b009aabedf2dc885c4ae0b8830d72cfcc2d01fe6a645152f478ca7b12135df75dcdb5e9fd277403c57
- SSDEEP 12288:Kphi6IsIEYno7UEwv0lUxrefoXSS9h55iAc2EinGI4pIF+xsAt9T/Hgjz0xfUNb+:K3iPhWZjvf49cAcTUGIFU5HCPFQf
- TLSH
  T169253344890CFB4FD08AC582DCB1AA4D22BCD7E9D309593F6FB2C9D37984587523EA49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  SWIFT 0000XXXX12 EURO DOO BEOGRAD.js
- Size 2.8MB
- SHA256 9683514cc99c80e7021849da4e9bd65d00c6d477f478589ea9aef522daed3c72
- MD5 28911e30fd8de82c143d4fe68907f2ef
- SHA1 1818450d75b3588b73dbfe2996e6b9f8a8d8b0c0
- SHA512 099987802513557d56ae2afed7f646c0d9d1ba4ba0ded2a26e09d35e1dc46628763819a1e1eec8842e93e4ef44d4028e3bccc52cb96d5ac8136ed807bb8baf7d
- SSDEEP 49152:Oajb0muGjbyeIHIDVhS1XzgR1IKzm59UQwsX9/vsyt3zMvZFtm5vH1P0fEv1ZC7Y:q
- TLSH
  T109D5E8B333AD1A1B2D2C33A4B40A5C898B8B75722D97E6C4B0EF45D8018F5E53654EED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution formbook persistence privilege_escalation rat spyware stealer trojan
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral3 behavioral4