General

  • Target

    img1910202258454857453739.exe

  • Size

    279KB

  • Sample

    221020-hqmjjsaef8

  • MD5

    ea4887c59777688d1eefd6611710224d

  • SHA1

    b4fd3fc6792f3d724bc17b235a14b459de0fb85a

  • SHA256

    9fd8b0f6c9167d26074c6b95b7cab23af2ac512f4dcdd8486309f489e8953e8f

  • SHA512

    081050a2aa2ae52d51ccff4bf7eb289998a5bf660df45e6fdd7c075383ecdd575ae7fc1c31b7beecbef745d4cbf974bb69977da9f0b7f17a38af6046bd356059

  • SSDEEP

    6144:81bn6zIMq4u2CorAIVvAGIVoozfRg4KAil0jRdEcc3imi44z4+uemsARMYg:k6zRqerAEvXgLRwIjIy30+jmsAWYg

Malware Config

Extracted

Family

formbook

Campaign

obc0

Decoy

A2gNIt4ZLE2WSRNqwwwpsBTT

KLiJs2j/oYJGXw==

GJ5AX02Bzirgole5H/xkbHxxxA==

nhGtQ1jESNk=

M/qrQ6/c8BjOhjUShQwpsBTT

hhjW6ZLD3W5/YSvc/w==

ck6CCdkGHGLCJeYHfoHi2jLrLkMI

M7hs+yxb421IZmQ4g0Y=

P/gftL3tjcgy1JT+Z0g=

v5xRZ1+PJTeGLQRDdVE=

IpZE4CpJa7qSObgbNNO0sAjey1PTVw==

CuMGreIQqVLMeVneRCnVh9LE

5Ig0zy1q8hFYwLGX9w==

wYxI1zZk7juqENdahFM=

8W4jMcvt8hKaBK3UNzfVh9LE

xVQHn+gbtydXi1mU

V9Z5FkCyPN0=

B8RxDECyPN0=

6u4Rp7nkvaoVsRo=

Efs21e4nxg8bux4=

Targets

    • Target

      img1910202258454857453739.exe

    • Size

      279KB

    • MD5

      ea4887c59777688d1eefd6611710224d

    • SHA1

      b4fd3fc6792f3d724bc17b235a14b459de0fb85a

    • SHA256

      9fd8b0f6c9167d26074c6b95b7cab23af2ac512f4dcdd8486309f489e8953e8f

    • SHA512

      081050a2aa2ae52d51ccff4bf7eb289998a5bf660df45e6fdd7c075383ecdd575ae7fc1c31b7beecbef745d4cbf974bb69977da9f0b7f17a38af6046bd356059

    • SSDEEP

      6144:81bn6zIMq4u2CorAIVvAGIVoozfRg4KAil0jRdEcc3imi44z4+uemsARMYg:k6zRqerAEvXgLRwIjIy30+jmsAWYg

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks