General

  • Target

    26a90fd97223d41acd7c811de377851e34afc3506d311385b27b2544f3829de4.bin

  • Size

    836KB

  • Sample

    210920-qh282aebh7

  • MD5

    c0621d2694aa84eb9fcf88ae5650824a

  • SHA1

    6df8c471357010bf2fcdf44ee2afe79617fe44a3

  • SHA256

    26a90fd97223d41acd7c811de377851e34afc3506d311385b27b2544f3829de4

  • SHA512

    d91bdfc88a9dfad1cc7911b24a7c42f681ae5f11b843912aa22d394dd26ca3ac1c496378660ac6919f9b5fbee64b46af8513f555e255b64af1cd74dda0007fcd

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nop

C2

http://www.jakesplacebarbers.com/3nop/

Decoy

videohm.com

panache-rose.com

alnooncars-kw.com

trueblue2u.com

brussels-cafe.com

ip2c.net

influenzerr.com

rbcoq.com

zzful.com

drainthe.com

sumaholesson.com

cursosaprovados.com

genotecinc.com

dbrulhart.com

theapiarystudios.com

kensyu-kan.com

dkku88.com

tikhyper.com

aztecnort.com

homebrim.com

Targets

    • Target

      26a90fd97223d41acd7c811de377851e34afc3506d311385b27b2544f3829de4.bin

    • Size

      836KB

    • MD5

      c0621d2694aa84eb9fcf88ae5650824a

    • SHA1

      6df8c471357010bf2fcdf44ee2afe79617fe44a3

    • SHA256

      26a90fd97223d41acd7c811de377851e34afc3506d311385b27b2544f3829de4

    • SHA512

      d91bdfc88a9dfad1cc7911b24a7c42f681ae5f11b843912aa22d394dd26ca3ac1c496378660ac6919f9b5fbee64b46af8513f555e255b64af1cd74dda0007fcd

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks