General

  • Target

    74a3379894a1b92cb381a128c7fe7c5f97e1a12df02588ec816d1a4fc5dc0a25

  • Size

    904KB

  • Sample

    221129-sbg1madb4w

  • MD5

    2364501a86685f9a53d37d339549cee5

  • SHA1

    ebacf33c1e9f53048a8e808429671ed489dc285d

  • SHA256

    74a3379894a1b92cb381a128c7fe7c5f97e1a12df02588ec816d1a4fc5dc0a25

  • SHA512

    1210b67603986cfa62d6ac7df1ac3da1aeb03d80716f605465967e8895ec9fd39106918b5de5f865b7ce937cc2f111849b88450b517201cc6ea4b2af269e819d

  • SSDEEP

    12288:8SYqU+RPN8z0WC9ZG5MyVh+rpDhl6loeY7XccEKjxN4qwkqpUKPPDdzoa1cfN:/JKzOZl56lE7McE6xN44ZKPPDdEPf

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

b3es

Decoy

sweets.wtf

apextama.com

tygbs.com

kumaoedu.com

bestbathroomremodeling.club

lnshykj.com

nelsonanddima.com

falunap.info

codyhinrichs.com

2797vip.com

danutka.com

3o2t307a.com

kellymariewest.com

profilelonn.online

procan.website

sopjimmy.com

xn--skdarkae-55ac80i.net

entitymanaged.com

melitadahl.art

joineguru.net

Targets

    • Target

      74a3379894a1b92cb381a128c7fe7c5f97e1a12df02588ec816d1a4fc5dc0a25

    • Size

      904KB

    • MD5

      2364501a86685f9a53d37d339549cee5

    • SHA1

      ebacf33c1e9f53048a8e808429671ed489dc285d

    • SHA256

      74a3379894a1b92cb381a128c7fe7c5f97e1a12df02588ec816d1a4fc5dc0a25

    • SHA512

      1210b67603986cfa62d6ac7df1ac3da1aeb03d80716f605465967e8895ec9fd39106918b5de5f865b7ce937cc2f111849b88450b517201cc6ea4b2af269e819d

    • SSDEEP

      12288:8SYqU+RPN8z0WC9ZG5MyVh+rpDhl6loeY7XccEKjxN4qwkqpUKPPDdzoa1cfN:/JKzOZl56lE7McE6xN44ZKPPDdEPf

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks