ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool Formbook

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: Formbook

NamesFormbook
CategoryMalware
TypeBackdoor, Keylogger, Info stealer, Credential stealer
Description(FireEye) FormBook is a data stealer, but not a full-fledged banker (banking malware). It does not currently have any extensions or plug-ins. Its capabilities include:

• Key logging
• Clipboard monitoring
• Grabbing HTTP/HTTPS/SPDY/HTTP2 forms and network requests
• Grabbing passwords from browsers and email clients
• Screenshots

FormBook can receive the following remote commands from the C2 server:

• Update bot on host system
• Download and execute file
• Remove bot from host system
• Launch a command via ShellExecute
• Clear browser cookies
• Reboot system
• Shutdown system
• Collect passwords and create a screenshot
• Download and unpack ZIP archive
Information<https://www.fireeye.com/blog/threat-research/2017/10/formbook-malware-distribution-campaigns.html>
<http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/>
<https://www.peerlyst.com/posts/how-to-understand-formbook-a-new-malware-as-a-service-sudhendu>
<http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html>
<https://www.arbornetworks.com/blog/asert/formidable-formbook-form-grabber/>
<https://thisissecurity.stormshield.com/2018/03/29/in-depth-formbook-malware-analysis-obfuscation-and-process-injection/>
<http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html>
<https://www.virusbulletin.com/virusbulletin/2019/01/vb2018-paper-inside-formbook-infostealer/>
<https://www.botconf.eu/wp-content/uploads/2018/12/2018-R-Jullian-In-depth-Formbook-Malware-Analysis.pdf>
<https://www.peerlyst.com/posts/how-to-analyse-formbook-a-new-malware-as-a-service-sudhendu?trk=explore_page_resources_recent>
<https://blog.talosintelligence.com/2018/06/my-little-formbook.html>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook>
AlienVault OTX<https://otx.alienvault.com/browse/pulses?q=tag:FormBook>

Last change to this tool card: 13 May 2020

Download this tool card in JSON format

Previous: FORKBEARD
Next: FormerFirstRAT

All groups using tool Formbook

ChangedNameCountryObserved

APT groups

XCobalt GroupRussia2016-Oct 2019X
 Operation Epic Manchego[Unknown]2020 
 RATicate[Unknown]2019 
 Sweed[Unknown]2017-2019 

4 groups listed (4 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key