Severity
Medium
Analysis Summary
FormBook is an infostealer malware that was first identified in 2016. It tracks and monitors keystrokes, finds and accesses files, takes screenshots, harvests passwords from various browsers, drops files, and downloads, and executes stealthier malware in response to orders from a command-and-control server (C2).
Formbook is known for its versatility, as it can be customized to target specific systems or applications. It is also designed to evade detection by security software, using techniques such as code obfuscation and encryption.
It disguises its original payload and injects itself into legitimate processes to avoid detection and complicate the removal process. The cybercriminals behind these email campaigns used a variety of distribution techniques to deliver this malware, including PDFs, Office Documents, ZIP, RAR, etc. This malware was used by cyber threat actors to attack Ukrainian targets in 2022 during the conflict between Russia and Ukraine. Currently, it is believed that the virus known as XLoader is Formbook's successor.
To protect against Formbook and other malware, it is important to keep software up-to-date, use strong passwords, and be cautious when downloading software or opening email attachments. Antivirus and anti-malware software can also help detect and remove Formbook infections.
Impact
- Credential Theft
- Data Theft
- Keystroke Logging
Indicators of Compromise
MD5
4060e0be415f7139495125a4d605cd07
a9828b4a97c2488c44ef8be767fd604f
355e945806d84abaecf94395c64fc219
d2522b1ce97f4736411f1f13aa0af640
3576e5d16b1d8f2a8e580cd2f40a67d1
SHA-256
42663033f143886f345bd3360c59c20332e0fb3c4d8377a9ef8acff74673c40e
7a9dfd4083ac768178f01c34659480b81aab334e087b91fe1055c9c43b8ac9aa
412934cdc4794191987bdee6aa6161dcae7ee21c5ab62c25aba1c9604c4ab0dd
9c482a3d9819df12b7a85d4930b40cb0006ca47006b8351279f8bbf1222f7eca
dadcc1aee3024cc0d05a344b128071fe566a63837ec3f2a4c24bc184c2c0c462
SHA1
719ae420c67a8faeaf66d90c9343bb1a5bae0b87
40a360888d9952a6d09d4f489ee44cd97d053837
d470ee2f69aa0299e6be154ff05a9bbfa01901ee
877d525585a568137e9c0cbb31331ad9efc9e1c0
e41d1c45b71bf4c762e20eacc5c014ed87365ed4
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Enable two-factor authentication (2FA) on your accounts adds an extra layer of security and can help prevent unauthorized access even if your login credentials have been stolen.
- Regularly backing up your important data can help ensure that you don't lose any critical information in the event of a malware infection or other data loss event.
- Be wary of emails, attachments, and links from unknown sources. Also, avoid downloading software from untrusted sources or clicking on suspicious ads or pop-ups.
- Make sure all of your software, including your operating system and applications, is up-to-date with the latest security patches. This can help prevent vulnerabilities that could be exploited by malware.