General

  • Target

    747dac1e7f06dfc43cd785fda4ef50c1b8f8dab4d02087f167c51c4ac465af3d

  • Size

    986KB

  • Sample

    221121-jrxlksac66

  • MD5

    1a5cde4d6ee08d06e2b8f7ef813feaae

  • SHA1

    2c7a5d2d1949ecfbf2b44429c41746840f72c728

  • SHA256

    747dac1e7f06dfc43cd785fda4ef50c1b8f8dab4d02087f167c51c4ac465af3d

  • SHA512

    3fa3b1ed9f8d2c3c8d7d0bc5c19ceb6a9c905bf2df149a06b111859bbefac89c41da5aaf9ec654e0854c1b36c629ffafa2bdeafb053f33d534e5c90cc30bdded

  • SSDEEP

    24576:Hh3y863CAGCbBM/PEKBtE0N1rINH4Tx2GZP+L74mBfNUstzo:Hh3Y3Cd6BzK510NHoF

Malware Config

Extracted

Family

formbook

Campaign

dcn0

Decoy

ZVx68vDtAMBCwg==

oBMBvsNORkM/O/ox

Ff9pISWkm6eG4lByIspp

c2T42c6CIIF6B8xTxm9XzpVw

bvjhxRbnAC183w==

0lTttSNG4HUDNflyIspp

hPXFlstqiHA/O/ox

WLR+MeerxZ0cNn1ja+IQAYo=

IHRn4xXOVKi477zarG+ObSy7YJA=

Xhf3e+tdAC183w==

Xk0ZAezv2rWH

kngo+vBeSRN7AszNwam3Osmguuqc0MoC

a2Qp7a+E8fSw7LDjpnqEKjsRZA==

3zjy4E7+QM48wg==

YcCmqT3OUNAigVott2pBKiy7YJA=

4+SMeX1juat/5cZ1AZihcyy7YJA=

/+m7sro0OBTl3TMpCw==

i2ctEfe4//a64yklMsgS2J90

+loZ2QKGX0UWgpvErMs=

b9BNCnJWQJS8IfsR0uR3bCy7YJA=

Targets

    • Target

      747dac1e7f06dfc43cd785fda4ef50c1b8f8dab4d02087f167c51c4ac465af3d

    • Size

      986KB

    • MD5

      1a5cde4d6ee08d06e2b8f7ef813feaae

    • SHA1

      2c7a5d2d1949ecfbf2b44429c41746840f72c728

    • SHA256

      747dac1e7f06dfc43cd785fda4ef50c1b8f8dab4d02087f167c51c4ac465af3d

    • SHA512

      3fa3b1ed9f8d2c3c8d7d0bc5c19ceb6a9c905bf2df149a06b111859bbefac89c41da5aaf9ec654e0854c1b36c629ffafa2bdeafb053f33d534e5c90cc30bdded

    • SSDEEP

      24576:Hh3y863CAGCbBM/PEKBtE0N1rINH4Tx2GZP+L74mBfNUstzo:Hh3Y3Cd6BzK510NHoF

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks