formbook

Sharing

Copy URL Twitter E-mail

General

Target
f46592fccdfe87478bfa33d5119ba8a52ce14f8b6bcd8ace66f0b7cb790d78d9.exe
Size 645KB
Sample251208-tc7hcafy9d
SHA256 f46592fccdfe87478bfa33d5119ba8a52ce14f8b6bcd8ace66f0b7cb790d78d9
MD5 02c94e2469eda4b383a97f53efdcf83f
SHA1 b9ebb0edd28e92a0b79c7ee1bc814f39b9a135da
SHA512 c67b2c70468921a823e3a526a3e64db4382ca979746462c28de1be255a0326af4ab110be05c0c8b1562c27c731a09771ac350f80e85452426b136676a23a23b7
SSDEEP 12288:DGzMtp481/xdghmmOsyFrzRob9Mk/LmjtG/:DGzMtp48Ldg8wUXRo9MIJ/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  f46592fccdfe87478bfa33d5119ba8a52ce14f8b6bcd8ace66f0b7cb790d78d9.exe
- Size 645KB
- SHA256 f46592fccdfe87478bfa33d5119ba8a52ce14f8b6bcd8ace66f0b7cb790d78d9
- MD5 02c94e2469eda4b383a97f53efdcf83f
- SHA1 b9ebb0edd28e92a0b79c7ee1bc814f39b9a135da
- SHA512 c67b2c70468921a823e3a526a3e64db4382ca979746462c28de1be255a0326af4ab110be05c0c8b1562c27c731a09771ac350f80e85452426b136676a23a23b7
- SSDEEP 12288:DGzMtp481/xdghmmOsyFrzRob9Mk/LmjtG/:DGzMtp48Ldg8wUXRo9MIJ/
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery formbook rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 20e642707ef82852bcf153254cb94b629b93ee89a8e8a03f838eef6cbb493319
- MD5 109b201717ab5ef9b5628a9f3efef36f
- SHA1 98db1f0cc5f110438a02015b722778af84d50ea7
- SHA512 174e241863294c12d0705c9d2de92f177eb8f3d91125b183d8d4899c89b9a202a4c7a81e0a541029a4e52513eee98029196a4c3b8663b479e69116347e5de5b4
- SSDEEP 48:S46+/+lTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8m0ofjLl:zMluPbOBtWZBV8jAWiAJCdv2CmHL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
- MD5 ec9640b70e07141febbe2cd4cc42510f
- SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
- SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
- SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Formbook family

Formbook payload

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8