General

  • Target

    c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1

  • Size

    414KB

  • Sample

    220127-q3mzvaeag5

  • MD5

    43357f80bc70e0db9fb0c304a962e3de

  • SHA1

    50b6a0a1fb9d9af63523b9a186e88c279c591274

  • SHA256

    c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1

  • SHA512

    186ce7a33d8bbbc821f689e7f736f8648b827c981a72eccddbeed1861b05bbc014866c8c138993981f6cd7bb864466ef21912c92f13d8072247efb02f5a60ff0

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

g2fg

Decoy

snowcrash.website

pointman.us

newheartvalve.care

drandl.com

sandspringsramblers.com

programagubernamental.online

boja.us

mvrsnike.com

mentallyillmotherhood.com

facom.us

programagubernamental.store

izivente.com

roller-v.fr

amazonbioactives.com

metaverseapple.xyz

5gt-mobilevsverizon.com

gtwebsolutions.co

scottdunn.life

usdp.trade

pikmin.run

Targets

    • Target

      c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1

    • Size

      414KB

    • MD5

      43357f80bc70e0db9fb0c304a962e3de

    • SHA1

      50b6a0a1fb9d9af63523b9a186e88c279c591274

    • SHA256

      c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1

    • SHA512

      186ce7a33d8bbbc821f689e7f736f8648b827c981a72eccddbeed1861b05bbc014866c8c138993981f6cd7bb864466ef21912c92f13d8072247efb02f5a60ff0

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

System Information Discovery

1
T1082

Tasks