General

  • Target

    notificación bancaria SWIFT pdf.exe.xz

  • Size

    285KB

  • Sample

    210909-rkwdyagce5

  • MD5

    50276323aa3aba8594b9c80ec69f702b

  • SHA1

    16428504561d41e4959ba9edafee0daf6f2c1deb

  • SHA256

    aee3cf37a620dd88a4ee0e615d924476ca41aa05eb4da5b6c4b2b43b9a8fa91f

  • SHA512

    c5c98b99183d60caec3b4dec8c608c8cbe712cb0dc0a5d5342f07a307e61f5c76b9f2b67bfb273dff6b730cbbc067e0977a3e1c94ec7ac91aa923bb23502ed11

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

n7ak

C2

http://www.kmresults.com/n7ak/

Decoy

modischoolcbse.com

theneverwinter.com

rszkjx-vps-hosting.website

fnihil.com

1pbet.com

nnowzscorrez.com

uaotgvjl.icu

starmapsqatar.com

ekisilani.com

extradeepsheets.com

jam-nins.com

buranly.com

orixentertainment.com

rawtech.energy

myol.guru

utex.club

jiapie.com

wowig.store

wweidlyyl.com

systaskautomation.com

Targets

    • Target

      notificación bancaria SWIFT pdf.exe

    • Size

      832KB

    • MD5

      790a8929e2da4ef90724d5459576dbd6

    • SHA1

      11e1e157ee06cf0b78d947178e3c1ba5a5bc324b

    • SHA256

      131218ce7bc6d946ea21940e0b434980b5aaba680514c12d766b8b18e785e2ee

    • SHA512

      176d02efb1c26cfbcba193c55a56530980c82ad6f39a9d6d57e4d975926ebbd61b1c80d41266e4c16be452c29a4c30aec2eff839271e75851052588f0af1e18e

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks