General

  • Target

    Gkjesdjokhownhmnzenqhirureonvyzjao.exe

  • Size

    715KB

  • Sample

    220808-ll2pfsbaf9

  • MD5

    e339968bd4859d65b757ef83159b0488

  • SHA1

    136c9c38a58ccbc9c6bebb48bba6100fc6eff206

  • SHA256

    5fabffc9eb6177ac29a1e51bf2a8bde55ddd97e2f7c86134eb2512b927f1232e

  • SHA512

    d134f5c7a6fbb61f0c4645e539b318e8dfe7eb83cfe9bfd198e5ea4161e3ab0aa5dd4148a6ba8454363080c483ca9225b3fa708181de7f86617fc24427280536

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

o2e7

Decoy

genvivwink.com

paramotos.space

bolsanoir.com

techblog.asia

seophreak.com

agitationt.net

jenniferlearmontcelebrant.com

biggsales.space

barkerprintsolutions.com

jesuspatriot.com

clinicaamadeolosmochis.com

lowbackpaindecoded.com

mumbaimasjid.com

masooliflourmillers.com

incopetent.com

andresramosweb.com

betonamubukkyoshinjakai.com

pukimail.net

erohlimitcrown.site

bodogegarden.com

Targets

    • Target

      Gkjesdjokhownhmnzenqhirureonvyzjao.exe

    • Size

      715KB

    • MD5

      e339968bd4859d65b757ef83159b0488

    • SHA1

      136c9c38a58ccbc9c6bebb48bba6100fc6eff206

    • SHA256

      5fabffc9eb6177ac29a1e51bf2a8bde55ddd97e2f7c86134eb2512b927f1232e

    • SHA512

      d134f5c7a6fbb61f0c4645e539b318e8dfe7eb83cfe9bfd198e5ea4161e3ab0aa5dd4148a6ba8454363080c483ca9225b3fa708181de7f86617fc24427280536

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Formbook payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation