General

  • Target

    regolamento fattura.rar

  • Size

    508KB

  • Sample

    211013-xdlh2sfae2

  • MD5

    57db1ee2d3c081f0b245389789f8b709

  • SHA1

    c8e09223393f458eab572de3270879b94b52eb42

  • SHA256

    76a8adb73b3b2f0d94ae2fceb1fc4c6307c318f102fffa93fb353bf94b204d38

  • SHA512

    ce6dc7937ccf6fe87f7f6cb7677b7b4586dc8aae618a3cc9a3ca00cd15eb8f1c9fa2cd991514a5e6b31a7b4cd71592c1e0ca08a6b65d4741020414fd5877333f

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

C2

http://www.yourherogarden.net/dn7r/

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Targets

    • Target

      OAa3nu595dA7afB.exe

    • Size

      553KB

    • MD5

      1823dce627d29f5d4985501267f7ad9f

    • SHA1

      1ce10042fccf2c8fcb2b0a93723f24b6c3b4ffb3

    • SHA256

      c14ba2023f89dc57df157690e40042b8b090906257c59b6e5834b2212cd3142e

    • SHA512

      88421fa99979a5ed7d55a2dccffbb96af3e72539e5dba61bf7860d2321a2f79deb5e9aae65e3fb9e5a17998a60d87abbbdc7b0dc495c991b4a3813a2ef8edb72

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Discovery

System Information Discovery

1
T1082

Tasks