General

  • Target

    Ziraat Bankasi Swift Mesaji.exe

  • Size

    469KB

  • Sample

    220620-rb57sadfhl

  • MD5

    25c2ebbd0e8c30072c147d523f0162f2

  • SHA1

    d0ceb65655fc301e34c7750d1cb44908ae4a18ae

  • SHA256

    859aada0cf09832daace8902102e39989f7eac7e3152006ea017a9f27e22b162

  • SHA512

    2984620b54c2b541c378ae34572d73ee19943dee1d3ab8095c047f432f18b4e0a6715503e9108d838c72f9fc7f20712b4e3450f51dc01f3a5aad9552098967e0

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pr28

Decoy

warehouseufohighbay.com

kingasia77.xyz

americanoutfittes.com

jemodaevangica.com

holigantv82.com

creamkidslife.com

skillzplanetoutreach.com

goldencityofficial.com

choiceaccessorise.com

kdgkzy.com

patra.tech

chicaglo.com

9491countyroad106.com

theultracleanser.com

lesmacarons.biz

kfaluminum.com

institutodiversidade.com

woodanqnmz.store

teslabuyerusa.com

cityofbastop.com

Targets

    • Target

      Ziraat Bankasi Swift Mesaji.exe

    • Size

      469KB

    • MD5

      25c2ebbd0e8c30072c147d523f0162f2

    • SHA1

      d0ceb65655fc301e34c7750d1cb44908ae4a18ae

    • SHA256

      859aada0cf09832daace8902102e39989f7eac7e3152006ea017a9f27e22b162

    • SHA512

      2984620b54c2b541c378ae34572d73ee19943dee1d3ab8095c047f432f18b4e0a6715503e9108d838c72f9fc7f20712b4e3450f51dc01f3a5aad9552098967e0

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Formbook Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks