formbook

General

Target
(1) 27.11.24_Licencia Para cancelación - A1 página-00020.docx.exe
Size 1.3MB
Sample241202-qectzavkhv
SHA256 c5a0052ac65201d36e99aa9719bb2daaae6d2faf98941a2b4f5c12a5946934ba
MD5 9dba20e8a9b2ba8aaa80da65d85daea4
SHA1 d652d051654c475c11f362104c80fb1a69ecd282
SHA512 b78411da91706f35af5d11d149ac0eecc1a7c6637e8c9567512c2cb510c5824e4a6a63b13838f6ad55e87df6a36391295b0f5e9a91982f37c967832ad0721ce4
SSDEEP 24576:vtb20pkaCqT5TBWgNQ7aFokJHs8qKo10IiGgvuP5Kg6A:sVg5tQ7aukJHtqKo10IiJv25
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ud04

Decoy

oum7.pro
ovonordisk.online
akrzus.pro
tendmtedcpsa.site
mm.foo
animevyhgsft29817.click
digdxxb.info
1130.vip
uy-now-pay-later-74776.bond
ybzert.online
edcn.link
rime-flow-bay.xyz
nd777id.beauty
otoyama.shop
lranchomx.xyz
unluoren.top
uglesang-troms.net
udulbet88.net
raquewear.shop
ijanarko.net
iuxy.host
itaxia.dev
hisewntbqg.makeup
talianfood.store
22gxx.app
tandkite.fun
rovideoeditor.shop
ires-86307.bond
elitjatarjoukset.click
rofilern.net
uycarpaylater-02-t1e-01.today
futurum.xyz
inance15.site
alance-ton-budget.net
tpuniplay.shop
dlpli.xyz
riteon.online
rippyshaker.shop
rn10.top
linko1win.icu
ugeniolopez.art
raphic-design-degree-68380.bond
narchists.info
uy-now-pay-later-25573.bond
gzvmt.info
df.clinic
onesome.store
imba-168.net
ayef.xyz
64axyozkgl.top
dult-diapers-53774.bond
ec.baby
el-radu-easy4y.one
asik-eye-surgery-63293.bond
p-inbox4.click
0417.one
ualitystore.shop
partments-for-rent-61932.bond
enobscotlobster.online
fhou.link
eo56a3oouu.top
cweb.cyou
hoe-organizer-za.today
p806.top
2creativedesign.online

Targets

- Target
  (1) 27.11.24_Licencia Para cancelación - A1 página-00020.docx.exe
- Size 1.3MB
- SHA256 c5a0052ac65201d36e99aa9719bb2daaae6d2faf98941a2b4f5c12a5946934ba
- MD5 9dba20e8a9b2ba8aaa80da65d85daea4
- SHA1 d652d051654c475c11f362104c80fb1a69ecd282
- SHA512 b78411da91706f35af5d11d149ac0eecc1a7c6637e8c9567512c2cb510c5824e4a6a63b13838f6ad55e87df6a36391295b0f5e9a91982f37c967832ad0721ce4
- SSDEEP 24576:vtb20pkaCqT5TBWgNQ7aFokJHs8qKo10IiGgvuP5Kg6A:sVg5tQ7aukJHtqKo10IiJv25
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

formbook ud04 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2