General

  • Target

    7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6

  • Size

    948KB

  • Sample

    221208-kb4wdshd57

  • MD5

    7f53b20635e357caab65fc28f8a3667a

  • SHA1

    62f910bf47b40a1c9bc578e71ce57aaa3dccd06c

  • SHA256

    7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6

  • SHA512

    0f55a2fcb97c856bf11f66c3b5bdb77e213e296987886507f4b18e4bc4c53f175b217a2318231a5db60891c43392578610e8d7cea570e0083b07e3053fbb5ff7

  • SSDEEP

    12288:Y2SxFBoGPtdUAyeiHuc+6eiK+6Os0a980pY+ZmBjHUk+qxK3o3:JSzBXl9PiHuFpiK+6Os0U8shZmBHO

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vr84

Decoy

intouchenergy.co.uk

lalumalkaliram.com

hillgreenholidays.co.uk

fluentliteracy.com

buildingworkerpower.com

by23577.com

gate-ch375019.online

jayess-decor.com

larkslife.com

swsnacks.co.uk

bigturtletiny.com

egggge.xyz

olastore.africa

lightshowsnewengland.com

daily-lox.com

empireoba.com

91302events.com

lawrencecountyfirechiefs.com

abrahamslibrary.com

cleaner365.online

Targets

    • Target

      7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6

    • Size

      948KB

    • MD5

      7f53b20635e357caab65fc28f8a3667a

    • SHA1

      62f910bf47b40a1c9bc578e71ce57aaa3dccd06c

    • SHA256

      7e1f215877d458883e98c874ce1226b561f0ddd5114dad6baef44d66d33a98a6

    • SHA512

      0f55a2fcb97c856bf11f66c3b5bdb77e213e296987886507f4b18e4bc4c53f175b217a2318231a5db60891c43392578610e8d7cea570e0083b07e3053fbb5ff7

    • SSDEEP

      12288:Y2SxFBoGPtdUAyeiHuc+6eiK+6Os0a980pY+ZmBjHUk+qxK3o3:JSzBXl9PiHuFpiK+6Os0U8shZmBHO

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks