General

  • Target

    3888d9c7bef045280ab7a5cdb50ec57b

  • Size

    361KB

  • Sample

    220922-2cdh9scdh6

  • MD5

    3888d9c7bef045280ab7a5cdb50ec57b

  • SHA1

    a98f4e5659bd3704b07bcfc52965820ab2752f78

  • SHA256

    99607d96ca718ce72871ebca1d1f2934e9a29e6a4033b287586514b776c76786

  • SHA512

    83107ab8c1d0fc620f1d5279028081b2c76dc744afa9c8029a39f22f6de6b6fcd6871aba5bc72b60a09b98edd9d86723b40f8f4914df69f66d5709e83f9f7b80

  • SSDEEP

    6144:/6A9+4ACfwOIpRLsdSQYYDmtQr1NGTRIhzcRkif5RRCBHrBT/TR93EARlNi1NEk:lfULsdSQYBQr1N+SJ2H5n+H9b73EAXNS

Malware Config

Extracted

Family

formbook

Campaign

i3tw

Decoy

016XYOaa546POq6CaRVpEfQ=

6WCLUcRz6K7qTqIK

bIa/9uWTepQa6eQd

32urdxWXgrknUIeDYktb

EojfLVA0GyB2mYgMgzdT

jFbHYJhPwpebnHjAY0pZ

gxSusEwA30uVtrErCrQ=

EeJOmOn63OaCHIw=

r3K0jTvKtOR4EV3q1dOdHgYVCLVG

6LEakplWzoSSLXZH3t6XDQ==

MThmlLavncxvAo1f3t6XDQ==

SqUmLs+BeJfa69kp7qSmIfuU5K3ZMg==

GuIYfF0o7zGPJY4=

AEd4Wd7JRsdzBX9dPgO7KNJY6NX2Sga4

E1SDU8MxGoZaPFgn9w==

cIq96QyWC/k1XDBRTR9FQOaLosd4Og==

/zRZMuaxmZnX291wZQCXhiq1his=

+47IMmwvk2jyx7MA

IGKz6DH4iraNLQ==

Kh1gHpxbw0MDkwSyaOqjKgTlK69R

Targets

    • Target

      092222 00109_pdf.exe

    • Size

      283KB

    • MD5

      1edf928f61d9ae78501dfdc4eb076661

    • SHA1

      5d448e3ea1ae1603785ecd6371be097b6bbf5e9f

    • SHA256

      c923b5976862e86bd94180a0f141ff001715eed24b895c1e4e2b066107c40412

    • SHA512

      913607f88456b1f08680934e52eb06ff3036c399164803f6a8cc07e72c5aa08be6f55b807219af10a1a5e18f313a9d50317387ab84f723e642e91e28e47c46f0

    • SSDEEP

      6144:GC3kNNEwg0zwQnfkpmCdrmBnf3wkUhH7ZnMpLCQy1GvhxpMG:D0zwak5KBf3B+Zaug7/

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks