General

  • Target

    75cdfaec4d70a869f819702c2a553048.exe

  • Size

    860KB

  • Sample

    221207-n891fsef32

  • MD5

    75cdfaec4d70a869f819702c2a553048

  • SHA1

    f720990a2ba4fdce268d923d464489a57cab9978

  • SHA256

    ddaf9934762825fb0168b9c861d81cbc664ee2248c912e0ed8bd980289577ee5

  • SHA512

    4548cc1e2713f9b87ca0a0b05ca6b4315e2825d4d02f49a3f1a55227899d33a5845adf0438febaddc797a6d5c2297c53002104fc7f2313de1443e035e37cfc68

  • SSDEEP

    24576:s35LjrZx3bwurBhQbxa1Q+SDkzR9FskHFt:s3drZx3bwurBhQbxa1lzhHFt

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dv22

Decoy

ivk-muc.com

theplantgranny.net

efefefficient.buzz

car-deals-87506.com

yangcongzhibo.net

empiralventures.com

latexpillo.com

ferramentafivizzanese.shop

kx1553.com

timamollo.africa

paran6787.net

fabicilio.online

kreativnettchen.shop

manakamana.co.uk

andreapeverelli.shop

jianf.site

kmqan.xyz

aoshilang.com

dnsmctmu.com

pumpkinsmp.net

Targets

    • Target

      75cdfaec4d70a869f819702c2a553048.exe

    • Size

      860KB

    • MD5

      75cdfaec4d70a869f819702c2a553048

    • SHA1

      f720990a2ba4fdce268d923d464489a57cab9978

    • SHA256

      ddaf9934762825fb0168b9c861d81cbc664ee2248c912e0ed8bd980289577ee5

    • SHA512

      4548cc1e2713f9b87ca0a0b05ca6b4315e2825d4d02f49a3f1a55227899d33a5845adf0438febaddc797a6d5c2297c53002104fc7f2313de1443e035e37cfc68

    • SSDEEP

      24576:s35LjrZx3bwurBhQbxa1Q+SDkzR9FskHFt:s3drZx3bwurBhQbxa1lzhHFt

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks