General

  • Target

    re, lista de productos qu¡micos.exe

  • Size

    696KB

  • Sample

    221201-smjctsbb64

  • MD5

    65a7879d2875f36c8450555c6c98f293

  • SHA1

    1464a6da1bf0438544946aadde4a6254f2d2400b

  • SHA256

    2cb3478355fda005cf47b9c74d29944815892efe821a57b0974969939c106d09

  • SHA512

    874b289d769145908b92f74b374b1e4e3b86f56dfea3838f73845365b099c198a256c2c998446c03b94a713071070640b0b41a19a0969e37ed2f3d35b861533d

  • SSDEEP

    12288:Dtpgh/PsZ1DX/VDJDAaIkDQoriWWl/pe1CDxfLo1:Rpgh/PCAr0ORB+CD6

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ng04

Decoy

tevimaq.com

easterspecialtystore.com

smartlever.tech

10312.uk

tanjawiharbi.co.uk

471338.com

horusventure.com

empress-care.com

sinrian.com

465951.com

aemsti.com

nxcourier.com

stargatefarms.com

lalyquainvestment.com

dailysportsadvice.com

justlistmoore.com

stoneonroll.online

tatianakolomiets.com

barcodebbm.com

protectorship.world

Targets

    • Target

      re, lista de productos qu¡micos.exe

    • Size

      696KB

    • MD5

      65a7879d2875f36c8450555c6c98f293

    • SHA1

      1464a6da1bf0438544946aadde4a6254f2d2400b

    • SHA256

      2cb3478355fda005cf47b9c74d29944815892efe821a57b0974969939c106d09

    • SHA512

      874b289d769145908b92f74b374b1e4e3b86f56dfea3838f73845365b099c198a256c2c998446c03b94a713071070640b0b41a19a0969e37ed2f3d35b861533d

    • SSDEEP

      12288:Dtpgh/PsZ1DX/VDJDAaIkDQoriWWl/pe1CDxfLo1:Rpgh/PCAr0ORB+CD6

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks