General

  • Target

    RFQ-SANOS-TENDER DOCUMENT_specifications001.doc

  • Size

    9KB

  • Sample

    221209-mh8h9sch92

  • MD5

    8f7574acf0737fc12d5019b19df45ff5

  • SHA1

    12be20df9be6591cd53003cc4c9e7388a672e41c

  • SHA256

    d8a5da9f780854652a37a5a4fdd812a99af1b26236adf4deac2ca38415224a8d

  • SHA512

    fe935974b8de54c093a7c355db5558f10ce3d7b156bd8b835ded53dee1afe650566ac88be6ea0c9d933f1d8db287787f08e71db93b3ee56d7afb24ea38511859

  • SSDEEP

    192:Xnu6W2UOd8LhywLTPG6Pw24rCKdDrAKVw3AsQ6aR3ijPWFqMw5OCjMaM:3f/UOd8Fyw3+kwr+KdrAUwwsQRR3ijp8

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

wh23

Decoy

ow9vyvfee.com

alvis.one

mutantgobz.claims

plynofon.com

southofkingst.store

nuvidamedspa.com

coffeeforyou56.com

opaletechevents.com

momobar.life

abcmousu.com

learnicd-11.com

tipokin.xyz

kahvezevki.com

suratdimond.com

oldartists.best

infoepic.info

mattresslabo.com

skarlmotors.com

cl9319x.xyz

med49app.net

Targets

    • Target

      RFQ-SANOS-TENDER DOCUMENT_specifications001.doc

    • Size

      9KB

    • MD5

      8f7574acf0737fc12d5019b19df45ff5

    • SHA1

      12be20df9be6591cd53003cc4c9e7388a672e41c

    • SHA256

      d8a5da9f780854652a37a5a4fdd812a99af1b26236adf4deac2ca38415224a8d

    • SHA512

      fe935974b8de54c093a7c355db5558f10ce3d7b156bd8b835ded53dee1afe650566ac88be6ea0c9d933f1d8db287787f08e71db93b3ee56d7afb24ea38511859

    • SSDEEP

      192:Xnu6W2UOd8LhywLTPG6Pw24rCKdDrAKVw3AsQ6aR3ijPWFqMw5OCjMaM:3f/UOd8Fyw3+kwr+KdrAUwwsQRR3ijp8

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks