General

  • Target

    REVISED ORDER FOR DECEMBER.exe

  • Size

    573KB

  • Sample

    221130-lxskxsch4y

  • MD5

    0e27fab3f710b0b524091aba6ed455c7

  • SHA1

    2b6aca7bc31a565f0cb1e00d9daab463b570f269

  • SHA256

    40f511e420e73d2cb620d782e9ed31dbd1dabe4103b31e025a4158d39a209a5e

  • SHA512

    d795b666ec53c9ed058c8fa77dac06e6e77f9d4871dfea8d59ebe49653b9b0620d292677482a88e81b276893948780db6ecc7b7e67ebb1c2a1995fc16876ba2a

  • SSDEEP

    6144:/+qpqSmgUZtFUaJqMJ3iwyoqAnrHxC4AbUkO0dDW8P4SATkU6Uk5dWXwzlf7Tvm:GqgSmdzUZAUndDWE4pkFv5DzA

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

f9r5

Decoy

teknotimur.com

zuliboo.com

remmingtoncampbell.com

vehicletitleloansphoenix.com

sen-computer.com

98731.biz

shelikesblu.com

canis-totem.com

metaversemedianetwork.com

adsdu.com

vanishmediasystems.com

astewaykebede.com

wszhongxue.com

gacha-animator-free.com

papatyadekorasyon.com

mqc168.top

simplebrilliantsolutions.com

jubileehawkesprairie.com

ridflab.com

conboysfilm.com

Targets

    • Target

      REVISED ORDER FOR DECEMBER.exe

    • Size

      573KB

    • MD5

      0e27fab3f710b0b524091aba6ed455c7

    • SHA1

      2b6aca7bc31a565f0cb1e00d9daab463b570f269

    • SHA256

      40f511e420e73d2cb620d782e9ed31dbd1dabe4103b31e025a4158d39a209a5e

    • SHA512

      d795b666ec53c9ed058c8fa77dac06e6e77f9d4871dfea8d59ebe49653b9b0620d292677482a88e81b276893948780db6ecc7b7e67ebb1c2a1995fc16876ba2a

    • SSDEEP

      6144:/+qpqSmgUZtFUaJqMJ3iwyoqAnrHxC4AbUkO0dDW8P4SATkU6Uk5dWXwzlf7Tvm:GqgSmdzUZAUndDWE4pkFv5DzA

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks