General

  • Target

    Siemens energy project drawings specifications.exe

  • Size

    1.1MB

  • Sample

    221004-sw3stsbffr

  • MD5

    a0b11b8dce6a0da27b042763acda5474

  • SHA1

    e4066f3d2d4439154a73b719ef1f6efed02dce57

  • SHA256

    71010bc51a53b2e1832e4267f893906df12f9bcd4717c22ca16dd26977db336e

  • SHA512

    c506a8f013e344131486801b50a7e1f87cfcf1e7a873c58442245559d67a2dfc74773611f2c8a1cb3fbff90829f6cda5e93dba8d5308a4072010de7061bdec6a

  • SSDEEP

    24576:htAJNzXgsKn878E/H+IolFiG5MrHUpH9NqB2+pzW1:psKnA/H+IoH5MrHUpdNqk

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vo84

Decoy

laurenciavachulova.one

sabuilders.store

masxot.xyz

matchfail.com

suararakyatnews.net

kykm.rest

richardsmartinezh.site

morehouseweneedyou.com

depressivepawnclub.xyz

yenilenme.net

allhiejralstore.com

9993808.com

sleepshastra.com

weplay-classic.com

propertyofpalestine.com

onirica.club

yohelios.com

fcorruption.com

tongdans.top

richmondmassage.store

Targets

    • Target

      Siemens energy project drawings specifications.exe

    • Size

      1.1MB

    • MD5

      a0b11b8dce6a0da27b042763acda5474

    • SHA1

      e4066f3d2d4439154a73b719ef1f6efed02dce57

    • SHA256

      71010bc51a53b2e1832e4267f893906df12f9bcd4717c22ca16dd26977db336e

    • SHA512

      c506a8f013e344131486801b50a7e1f87cfcf1e7a873c58442245559d67a2dfc74773611f2c8a1cb3fbff90829f6cda5e93dba8d5308a4072010de7061bdec6a

    • SSDEEP

      24576:htAJNzXgsKn878E/H+IolFiG5MrHUpH9NqB2+pzW1:psKnA/H+IoH5MrHUpdNqk

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks