General

  • Target

    e240812c35bacf92c202060e8cf794cea45794d87188d0aa8d20957f07299b01

  • Size

    28KB

  • Sample

    220727-ra7dfseedr

  • MD5

    6aa3ec01c02065ec554c4d9e7c487a82

  • SHA1

    53b6ae871fdd19e420b2723f2f35465d8b791ad5

  • SHA256

    e240812c35bacf92c202060e8cf794cea45794d87188d0aa8d20957f07299b01

  • SHA512

    ee4df39cd8b306f7a1cd6e1bdf442b197cad984cab8659e8342ae7a07f7e189e4c3a8f2d7136ce1a9cf0db5fb6065d16b3871c6bbb5704431a2bc4dfe58a2169

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s4s9

Decoy

qianyuandianshang.com

bernardklein.com

slhomeservices.com

findasaas.com

janellelancaster.xyz

umkpro.site

nr6949.online

mersquare.club

lanariproperties.com

3rdeyefocused.com

giftexpress8260.xyz

hilleleven.xyz

beajod.com

kosazs.online

ishare.team

mb314.com

xjjinxingda.com

ayekooprojectamazing.com

ballsybanter.com

todayshoppingbd.com

Targets

    • Target

      e240812c35bacf92c202060e8cf794cea45794d87188d0aa8d20957f07299b01

    • Size

      28KB

    • MD5

      6aa3ec01c02065ec554c4d9e7c487a82

    • SHA1

      53b6ae871fdd19e420b2723f2f35465d8b791ad5

    • SHA256

      e240812c35bacf92c202060e8cf794cea45794d87188d0aa8d20957f07299b01

    • SHA512

      ee4df39cd8b306f7a1cd6e1bdf442b197cad984cab8659e8342ae7a07f7e189e4c3a8f2d7136ce1a9cf0db5fb6065d16b3871c6bbb5704431a2bc4dfe58a2169

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks