formbook

General

Target
commande.vbs
Size 16KB
Sample251015-nydjhay1hv
SHA256 6385ba95a2f179fac688bc5524caebdd20de2fdd3ddbbc531351f8db1965660c
MD5 f1bb23f681468bd0a06ad4aa45bd1706
SHA1 2083ad5d3396b58d4edc29cbe73d7407d3187cc3
SHA512 f30cd625c7c38a378a75eaaddce9db7e17a53d00ca4118990c2b28a7e7dac5e79785fede6390ec8029c873e076522c3f479e55eb38c5f760334d47e7fddf1512
SSDEEP 384:tqSztrJbtcSokgXmXx6IFhPQmtLqknE8HLF+8Rt0Vp:tbRrJKMgIDLhlE8ra
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  commande.vbs
- Size 16KB
- SHA256 6385ba95a2f179fac688bc5524caebdd20de2fdd3ddbbc531351f8db1965660c
- MD5 f1bb23f681468bd0a06ad4aa45bd1706
- SHA1 2083ad5d3396b58d4edc29cbe73d7407d3187cc3
- SHA512 f30cd625c7c38a378a75eaaddce9db7e17a53d00ca4118990c2b28a7e7dac5e79785fede6390ec8029c873e076522c3f479e55eb38c5f760334d47e7fddf1512
- SSDEEP 384:tqSztrJbtcSokgXmXx6IFhPQmtLqknE8HLF+8Rt0Vp:tbRrJKMgIDLhlE8ra
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

execution formbook rat spyware stealer trojan defense_evasion
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Formbook family

Formbook payload

Badlisted process makes network request

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2