General

  • Target

    765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725

  • Size

    576KB

  • Sample

    220724-smf8gagfdm

  • MD5

    104a0fd298792b9a5d0c6a9113822a34

  • SHA1

    4dee1d7dc239bcf8810f3ffc201ba5d203101f4d

  • SHA256

    765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725

  • SHA512

    d935416d2d20872cfe4a958c6557386f5945fc5739f30a293119412423b9657d097dbcdbaa29cbf01cd496a4466af206a8e77cda46a7d1c5f92057766c56d128

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

un

Decoy

mtbeautyshop.com

tactilon.online

bghuqo.com

ethansung.com

learntoskimboard.com

pzaintl.com

oaiteamv.com

advantahc.com

kudzuandcottoncompany.net

racinesdespres.com

go-kart-kits.com

travelbytravant.com

magamag.com

zhishengda.net

kamikacomics.com

colegiosantodomingord.com

apppose.com

esperandoporvoce.com

smartmallshopping.com

wwwvns9722.com

Targets

    • Target

      765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725

    • Size

      576KB

    • MD5

      104a0fd298792b9a5d0c6a9113822a34

    • SHA1

      4dee1d7dc239bcf8810f3ffc201ba5d203101f4d

    • SHA256

      765ed4f4607cc86d76be8e42930e43ba0c833866fb6bdd9b97c23241a46c6725

    • SHA512

      d935416d2d20872cfe4a958c6557386f5945fc5739f30a293119412423b9657d097dbcdbaa29cbf01cd496a4466af206a8e77cda46a7d1c5f92057766c56d128

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks