General

  • Target

    8bdd2be4252011abdf68e5db8180c2e89988209789a204ed01c5d9c9a84aa66a.exe

  • Size

    886KB

  • Sample

    230105-qyj3dscb55

  • MD5

    7481e627c46fc20dfebfeaa0c33cc70f

  • SHA1

    7727ff419b18cb88c45cb17faa935d40e9e37d9a

  • SHA256

    8bdd2be4252011abdf68e5db8180c2e89988209789a204ed01c5d9c9a84aa66a

  • SHA512

    5e389db1a08c191ca3d1fb37dbbd7ddd385e2d037a67f5cef5f5fc05e47be21f8bb7ccfbcadd3ee7f13483ae2e9100c015ffe83f511b602ca60d7d1fa56fed44

  • SSDEEP

    12288:aoQgKZ/nXt7virmWhlGLaQYIL0dRYSV9kyOFya1z6KhbI8GXrLHPENrks28RVjma:v/NxGz7+B7DPEln

Malware Config

Extracted

Family

formbook

Campaign

0vh9

Decoy

kT0Usm0+fHGF7CkiArMh/tpf8d/XmQE=

0fmX7QILD44W+4BvafbZzOs=

cu0K8dW1ampaxA==

mMUbaeih2AfncJFGQQ==

hbUGHyjFfvGHWhfdzKFAKACZFug=

yjwyDLSAuuQScZpTEt/p0g==

QVOuL9rCqaSZBDn18NM=

80J9zt627lL0

dRXhSLjVSYyE2g==

QuSd7Qu7JmkOkqOTf9gC4P5d322R+Ak=

TGmyjSzk7VR50A==

Per96I1KSYyE2g==

smg9xW2N/NH8O5xPQw==

epfEwPC7ggR37cX39cc=

s2tPNeqhoGyRpCQevaVh

0HJrO9mYxtjW0m+nEfbZzOs=

9ppmyuPh6JiKX+17X/bZzOs=

wrxE0u6FSNp5RtFYT83Yj+s2sz4kyg==

y4FnMsyMjUo7DqoovqLXyw==

tWNC35fFQyZe1Mt7fAQyHuycNOs=

Targets

    • Target

      8bdd2be4252011abdf68e5db8180c2e89988209789a204ed01c5d9c9a84aa66a.exe

    • Size

      886KB

    • MD5

      7481e627c46fc20dfebfeaa0c33cc70f

    • SHA1

      7727ff419b18cb88c45cb17faa935d40e9e37d9a

    • SHA256

      8bdd2be4252011abdf68e5db8180c2e89988209789a204ed01c5d9c9a84aa66a

    • SHA512

      5e389db1a08c191ca3d1fb37dbbd7ddd385e2d037a67f5cef5f5fc05e47be21f8bb7ccfbcadd3ee7f13483ae2e9100c015ffe83f511b602ca60d7d1fa56fed44

    • SSDEEP

      12288:aoQgKZ/nXt7virmWhlGLaQYIL0dRYSV9kyOFya1z6KhbI8GXrLHPENrks28RVjma:v/NxGz7+B7DPEln

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks