Rewterz Threat Alert – FormBook Malware – Active IOCs

Severity

Medium

Analysis Summary

FormBook is an infostealer malware that was first identified in 2016. It tracks and monitors keystrokes, finds and accesses files, takes screenshots, harvests passwords from various browsers, drops files, and downloads, and executes stealthier malware in response to orders from a command-and-control server (C2). 

Formbook is known for its versatility, as it can be customized to target specific systems or applications. It is also designed to evade detection by security software, using techniques such as code obfuscation and encryption.

It disguises its original payload and injects itself into legitimate processes to avoid detection and complicate the removal process. The cybercriminals behind these email campaigns used a variety of distribution techniques to deliver this malware, including PDFs, Office Documents, ZIP, RAR, etc. This malware was used by cyber threat actors to attack Ukrainian targets in 2022 during the conflict between Russia and Ukraine. Currently, it is believed that the virus known as XLoader is Formbook’s successor.

To protect against Formbook and other malware, it is important to keep software up-to-date, use strong passwords, and be cautious when downloading software or opening email attachments. Antivirus and anti-malware software can also help detect and remove Formbook infections.

Impact

• Credential Theft
• Data Theft
• Keystroke Logging

Indicators of Compromise

MD5

• 2161320afcb3ee6043cf2388e2d808eb
• a7d52b8263aeb32df44c71f71f258836
• 58e898b72261d02b92b7d5cb321437dd
• 516dbf5f215c60884bbfd5d73a558a3f
• d0106e5e3387d66d2d64920f9bd3fe78
• 8b5bdf8ac612f2ebe7ad3656a43b42fb
• 0aaff8b94963d0a486278122239679e4
• b433a859a4e3921530a949b2cbdf833e
• 62763ea99a08c8de0139281ea02be501

SHA-256

• 06efbb3e22f2645b35f5296531d60952079099fb9f87ca657f4376a3e3211d08
• 00d1bd4fb6f0afc0345136a810f410fb2c1740fd8adf0793e3cf6597f9bc7447
• d14a268b602bac6e49e1fa049815cd7898ffc04ff144445c4ecf4e983e412ecb
• ca40b5af11fef87fa85429195eb7e1e43f2c1921d60472670726abbece043715
• c04374ac98fa8740033c44f7a55d06c393324a219869a055dfaabcf43864550c
• cb348e8dbd6c518a9ad671a9fb235cea3eeba8b7036fc5498f6b118d4bc3060b
• ba87833650638887e614907d340085b6d0ca42d059701654a26b5dd6ffbd985d
• 97cf5a395e57db0d83a09daed5c2010c5fedce8a6acae4de2d963ecd9550708c
• 41877fb7bc2bfb83e6ec4b28dc8be3fd3182ea2502c45b1b1447b72b76702ef5

SHA-1

• 7c75c343183f9202b458c924119a3c36177f9374
• ad8c92cf6d2533aedf70206221777e574f537226
• af902525b5bb1d877e57cb30398dd5793412a05d
• de72ba40ecd456c1d18108ad4ab87c6d733b559a
• 33b2c5f19f4b86652f157085dd2fa24d1faeb296
• 336f0aec4422efbb8716d2fc37ba4e5ee29b088f
• ccec02f9fc4131c08f346e71ac0153f9daf626da
• 3e947be1b6a6460dc146b3ddb6669c5936effa2c
• 99f481ad361658bbe70f3adf1e558131af3fce3f

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Enable two-factor authentication (2FA) on your accounts adds an extra layer of security and can help prevent unauthorized access even if your login credentials have been stolen.
• Regularly backing up your important data can help ensure that you don’t lose any critical information in the event of a malware infection or other data loss event.
• Be wary of emails, attachments, and links from unknown sources. Also, avoid downloading software from untrusted sources or clicking on suspicious ads or pop-ups.
• Make sure all of your software, including your operating system and applications, is up-to-date with the latest security patches. This can help prevent vulnerabilities that could be exploited by malware.