General

  • Target

    bd811d9e445bb6882d2864faaf80f668.exe

  • Size

    897KB

  • Sample

    221207-n88sdshg6y

  • MD5

    bd811d9e445bb6882d2864faaf80f668

  • SHA1

    1ee49be423203c7034a6189b0364abfab6e02036

  • SHA256

    268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63

  • SHA512

    7f1421afb65de1d60dfe5515a497b9d3c1b4c94f827d85604fa8106c0b69162f4a95463d4dd9c34b1eeb69a55ecdedce175bc938985d5a4b141e6a5b89c202df

  • SSDEEP

    12288:x7oQgKZ/nXt7virmWhlGLaQYI1N6kowFheAjRjWf2yS/nhkehKuk5p/kAJF4JzrM:xLvFhecWf2bky0/P45rAQfWeQkNs

Malware Config

Extracted

Family

formbook

Campaign

w086

Decoy

F6jSz+l9QmYXguG/xUipf/6ixrik

cQZre8twfBVOOJgLenGTGA==

pG5kW2/wqwEOCVxZ

KORXeYwt7wF8J3BR

HL0ZdBMjeHet

TR57b4Yi6wJ8J3BR

fRyK2yaqeDRGHiQTTw==

RwhsqfRxABNZS59wenGTGA==

GuZaY4H4ahcWKjUdVg==

I5C4/Wyz3fglj+o=

Te5QPEu3NjZ0P58LenGTGA==

M9YJLwifZIi9pfnj2Nj/kA6+ZlU=

c/JFdRndG8f/HiQTTw==

nMmcD1UjeHet

QWR7+9Rh8/l8J3BR

9MD+BzOyI6mXtM4w6LMyEA==

WABgaYPqdJzl2TviGbdH

02OexRebqj3+U2kXhQ0=

j17M2R3/fQwFHiQTTw==

dQpReYss5/l8J3BR

Targets

    • Target

      bd811d9e445bb6882d2864faaf80f668.exe

    • Size

      897KB

    • MD5

      bd811d9e445bb6882d2864faaf80f668

    • SHA1

      1ee49be423203c7034a6189b0364abfab6e02036

    • SHA256

      268552c2ffe8fbb6b8a2244ce2931ca115a4057d74bfb72fc7ba91b95d95ac63

    • SHA512

      7f1421afb65de1d60dfe5515a497b9d3c1b4c94f827d85604fa8106c0b69162f4a95463d4dd9c34b1eeb69a55ecdedce175bc938985d5a4b141e6a5b89c202df

    • SSDEEP

      12288:x7oQgKZ/nXt7virmWhlGLaQYI1N6kowFheAjRjWf2yS/nhkehKuk5p/kAJF4JzrM:xLvFhecWf2bky0/P45rAQfWeQkNs

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks