General

  • Target

    Request For Quotation.exe

  • Size

    1018KB

  • Sample

    221127-p7g4qahf63

  • MD5

    0f4745cd79581770c068c19a5c94662f

  • SHA1

    cded3cd2bf67d20c0e769eb040a1cdcf224f7716

  • SHA256

    90c6128ca426717f3aab904fda4124ae91a1aad1a670b0f5b8a2b210a19d721d

  • SHA512

    50a57a7cb941f5161fc6c137e746b40b6fd7fda30bdefd9f640c7ad1a724fcac2c1bdd97aa349457e3100f4933a1c4d63e6f1d0d570c4d7a41b26b293a887f6b

  • SSDEEP

    24576:BOcUaLBDPLqmRm29EJxeRuaJOuy3yD+L74mBfNUstzo:BOcUUPLFY29HBJON3

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

oi05

Decoy

fluidavail.online

blchain.tech

kyocera.website

sangmine.xyz

thepolicyjacket.info

ssvhelpman.net

y-t-design.com

eminentabroad.com

codingcamp.store

bester.capital

tanjiya23.site

bheniamyn.dev

top5monitor.com

bit-prim.trade

airstreamsocialclub.com

darkwarspod.com

zazisalesdistribution.com

vivolentlo.online

daftburo.net

elemangelsin.xyz

Targets

    • Target

      Request For Quotation.exe

    • Size

      1018KB

    • MD5

      0f4745cd79581770c068c19a5c94662f

    • SHA1

      cded3cd2bf67d20c0e769eb040a1cdcf224f7716

    • SHA256

      90c6128ca426717f3aab904fda4124ae91a1aad1a670b0f5b8a2b210a19d721d

    • SHA512

      50a57a7cb941f5161fc6c137e746b40b6fd7fda30bdefd9f640c7ad1a724fcac2c1bdd97aa349457e3100f4933a1c4d63e6f1d0d570c4d7a41b26b293a887f6b

    • SSDEEP

      24576:BOcUaLBDPLqmRm29EJxeRuaJOuy3yD+L74mBfNUstzo:BOcUUPLFY29HBJON3

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks