Rewterz Threat Alert – FormBook Malware

Rewterz Threat Alert – Cobalt Strike Malware – Active IOCs

August 16, 2022

Rewterz Threat Alert – REvil Ransomware – Active IOCs

August 17, 2022

Rewterz Threat Alert – FormBook Malware – Active IOCs

Severity

Medium

Analysis Summary

Since 2016, FormBook has been active as a data-stealing malware that affects 4% of enterprises in 2020. It tracks and monitors keystrokes, finds and accesses files, takes screenshots, harvests passwords from various browsers, drops files, downloads, and executes stealthier malware in response to orders from a command-and-control server (C2). The cybercriminals behind these email campaigns used a variety of distribution techniques to deliver this malware, including PDFs, Office Documents, ZIP, RAR, etc.

Impact

Credential Theft
Sensitive Data Theft
Keystroke Logging

Indicators of Compromise

MD5

ccf8723b1dc529e37700010fc1b98569
ba9849c8008cd59470836c08468cf901
e9e56812742d598f57ec249696cfa90f

SHA-256

7ed46cb2fd59f1ded634cb51925223e684a6080ca0268c406ce63d2c6b57f338
3b520fa20ca7de3ec42ddff17915a68c486136893a619d0abf8b6a2902a211e9
b95ce5a91875b0094d2905b058b3623afd21c61e895af0b337d7a541847c961a

SHA-1

e51c67dfa84c7323a707475294a7dcb173876233
33a6a4ab2386359d9a0e651eaf1feacd6c20640d
e6c4e279fce76dd92033a583fbaca8bf792edb27

Remediation

Block all threat indicators at your respective controls.
Search for IOCs in your environment.