General

  • Target

    E-INVOICE.exe

  • Size

    35KB

  • Sample

    221012-ja1lxacha2

  • MD5

    26c3dd71f41e5f09a545057e6057cc31

  • SHA1

    d0fa018265ab24aa7fbea7f99a33fb6fb4b64814

  • SHA256

    35cd0956415cdbaece5b2791b1e8f5d1502aff0f6d36745a675e95c834d82fee

  • SHA512

    f5fa742dfadf96640135d191412c4af4fae8a4bcf191fde1b0ccdb9930687d268039796a0694bc41d8e5a16377ed9898173d5c078b09768e14c34f8e1e5c9233

  • SSDEEP

    768:YW3QTcfujslST5lpZBBiJfV7cGiRPPRMNB:jcrT5jAVVgGixPCNB

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

b01r

Decoy

ra-li.com

ttcap.art

shapeshop.site

estilo-accessories.com

xinliuzengzhang.top

edunowblockparty.com

247video.biz

tridex.africa

qwujt2.xyz

ivorroberts.store

phpmbai.site

lesec-talme.cfd

bcmii.us

whalesnft.online

dental-implants-usa-3.world

25062.top

peinture.photo

serkanotokurtarma.com

okzxvv.top

reefkitchenssetlement.com

Targets

    • Target

      E-INVOICE.exe

    • Size

      35KB

    • MD5

      26c3dd71f41e5f09a545057e6057cc31

    • SHA1

      d0fa018265ab24aa7fbea7f99a33fb6fb4b64814

    • SHA256

      35cd0956415cdbaece5b2791b1e8f5d1502aff0f6d36745a675e95c834d82fee

    • SHA512

      f5fa742dfadf96640135d191412c4af4fae8a4bcf191fde1b0ccdb9930687d268039796a0694bc41d8e5a16377ed9898173d5c078b09768e14c34f8e1e5c9233

    • SSDEEP

      768:YW3QTcfujslST5lpZBBiJfV7cGiRPPRMNB:jcrT5jAVVgGixPCNB

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks