Rewterz Threat Alert – FormBook Malware

Rewterz Threat Alert – Ursnif Banking Trojan – IOC’s

July 30, 2021

Rewterz Threat Alert – APT32 Ocean Lotus – Active IOCs

July 30, 2021

Rewterz Threat Alert – FormBook Malware – Fresh IOCs

Severity

Medium

Analysis Summary

FormBook is an information-stealer malware that has been active since 2016. The info-stealer malware’s capabilities include stealing credentials, capturing screenshots of victim’s desktop, monitoring clipboard, keystroke logging, clearing browser cookies, downloading and executing files, uploading and removing bots, launching commands via ShellExecute, downloading and unpacking ZIP archive, rebooting and shutting down the system. The attackers behind these email campaigns used a variety of distribution techniques to deliver the FormBook info-stealer, including PDFs, Office Documents, ZIP, RAR, etc. Some of these files are related to quotation requests.

Impact

Credential theft
Keystroke logging
Data Theft

Indicators of Compromise

MD5

7d797008843c8d30cf85c1818c9f4567
4a1051bd16e2fd2e017ba346059572a0
0c737a6befc4bba6c1ddba35d396f9d6
6fcfd40e4d1acc3866b1751f84aee568
166ae61fd9e86daa02b2a99d61a20260
4efe1df7cd9d64ba29c001a1f810fc1d
6549649ac3173aca1bb5ed1a99810380
b2b39c5683c85f14d7f9ab852bef94f1
9d1f8dfbbec2a01e490a143732537161

SHA-256

5b9d90e7b46998b1f8791b8e405d409ee52f0e2ba4235c8e450cc51a3381cfe7
edda9af73a29d4e3456a1fd3a67d3a1aabd9692d4f4feba564db139f86201960
f6bd2853a8346c75b10f30184adf3a12ddcc7b25dac4a1b0a5e281179b1e1322
38e4be0b1612a87858ee40b6c9eebd264d02e4488a34c3f1269ca385b01d1b20
e4c83edd228903feb00a1335f5182f4576f44766b9303689abb021dfe720c59c
a65412a0b9de3677e7620b1fa5c115211fa9e6425584adc24985f89e8a234785
ec07f953fea536e8ae3a92b862b6fa0ab1e6d76369a8b3d1c07ee65bc3525dcb
6b7ed46b4b978bc0356fd8e5ae04b63b3b5c0c5116dc6272ca0d95f266c621ce
c5f8abb4a78eee32369b6b5214c411cb9e7c7656b2ba13d0ebb37ad06f099b02

SHA-1

1a801680099cbbd5d38a985def7850bb44303db3
dccda8c3161a697597b8139b2b84107a47dbe567
e8e1dc5a5df9cc353f5a8be32dd19eef38a5b909
f8f7be9f46f84b95e1f70ae85c177e28a0d80590
fce406847a82b2e66dcb2bd8a592c3763f6b311c
4f472eeb47144652b2bc0a2b00c49b3ee001145f
3c8c5a9699e8d979c8f83b53c7fed73737ed99e7
31e2b7ecfac4f40712a16629a1dc1e41c7e6c991
85ee0af36e6ce8ebb7f7d9aa7f4df8b17133ae91

Remediation

Block all threat indicators at your respective controls.
Search for IOCs in your environment.
Do not download files attached in untrusted emails.