Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
8 IOCs

Malware Analysis — Formbook

0xMrMagnezi
0xMrMagnezi
Published April 1, 2024Original Report

Malware Families

Excerpt

Malware Analysis — Formbook Formbook is a type of malware that specializes in stealing sensitive information from infected systems, primarily focusing on capturing keystrokes, clipboard data, and form data from web browsers. Figure 1: Malware Bazaar Entry After downloading and extracting the .bat file, we observed a relatively simple obfuscation technique — Base64 encoding. At the end, there was a large chunk of code that appeared to be a file. Figure 2: Obfuscated Base64…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREmail.agagroup.lvCAPABILITYFormBookVICTIMunknown
Adversary
Infrastructure(1)
Capability(1)
Victim

Indicators of Compromise

Open the mindmap →

8 indicators

TypeIndicatorConfidenceScoreFirst Seen
MD52effd68ca29fb310fbe40749eb566d0eMediumScore 53/100First seen
MD5f362f6f1dd0d9521752008cb1789a699MediumScore 53/100First seen
Domainmail.agagroup.lvHighScore 58/100First seen
Emailremiset@remisat.com.uyHighScore 58/100First seen
SHA256463b92101e5f2912781dd6eb61374b97f14fb27b6fe05c0ef3fb734d8ef4d4ecMediumScore 53/100First seen
MD5cbd924de2846331d88a342757c53fe08MediumScore 53/100First seen
Emailinfo@agagroup.lvHighScore 58/100First seen
MD556e3f56dda234344fb2799c10727e642MediumScore 53/100First seen

IOC Relationship Graph

Building graph…