General

  • Target

    1e2499187de0cc218823f81fe3d62a284a9220d62401a1510489682de9b32857

  • Size

    236KB

  • Sample

    221012-tdqwzsaceq

  • MD5

    359fcad9ab0d8c7e8b7a37a71ad3ca62

  • SHA1

    ce1a50828ef2bf7ac4e4a8087be562608d6ea333

  • SHA256

    1e2499187de0cc218823f81fe3d62a284a9220d62401a1510489682de9b32857

  • SHA512

    eb1cf064da1c8c79d7df9f54e07f7cbfbbc8b2ade7a1e7a6cdf876a1f37d68950a168a93de057a2be89c5797ace88335521eb9301d930d274e168b56ec48ab17

  • SSDEEP

    6144:QhfSqW96QlU0yyw1GvwrH+vhSTLlG3S+GSh:txKGorevKG3LGS

Malware Config

Extracted

Family

formbook

Campaign

s6n0

Decoy

Rjdlh6/zHSTR8l/qBc5Sli4N

bhgURHTfHUEmULTxQLSp

3Mn6FAv7Rt3FIPw5+kA=

zzm54WQwP1JMitEUPCXw2Mtf7nw=

lH+0SLi17B0EImL9kIHJZTzN0g==

w4e94tKevUJDrXDKWQ==

jX0l3sCks02uxLWsBEY=

0HzjTYsaHz32

9uPhvBK58Xw=

AHhhDXWv7IXlXM1M

iudYICANV+wWQVi7yvUscCc=

nhEVQEw1bBqdx1aARrFLZjA=

hOLnEhr977jtBeQlD5GrJG0F

WztsD4N8tOilL+oaXA==

XjhvrbHxpFuwL+oaXA==

o30u6uO9C7rY+fVt5dFbflBuv2M=

oo3Lbi1e215kpdUB/HDcZTzN0g==

uZHWfdvQBDpCVl7qhnlDZTzN0g==

LJmOPvgvTFz7XrDXlBtSli4N

VxULunnWfwDG92nqBMgaXE8r63Y=

Targets

    • Target

      1e2499187de0cc218823f81fe3d62a284a9220d62401a1510489682de9b32857

    • Size

      236KB

    • MD5

      359fcad9ab0d8c7e8b7a37a71ad3ca62

    • SHA1

      ce1a50828ef2bf7ac4e4a8087be562608d6ea333

    • SHA256

      1e2499187de0cc218823f81fe3d62a284a9220d62401a1510489682de9b32857

    • SHA512

      eb1cf064da1c8c79d7df9f54e07f7cbfbbc8b2ade7a1e7a6cdf876a1f37d68950a168a93de057a2be89c5797ace88335521eb9301d930d274e168b56ec48ab17

    • SSDEEP

      6144:QhfSqW96QlU0yyw1GvwrH+vhSTLlG3S+GSh:txKGorevKG3LGS

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks