General

  • Target

    tmp

  • Size

    922KB

  • Sample

    230316-d9zk1abb2x

  • MD5

    b3c8c2559e752ab1fdacfbfa0578438d

  • SHA1

    b65a0bdf8d8b8ab3708fa8281d3a9e6885f5827b

  • SHA256

    bf03cd8e5554ec62c98931069f436ec71ac21d57a8922b1bb3c1958a0a9256f3

  • SHA512

    0bdec1e727359853fe84f12757adb4ca6f3a9385c92930a3acffcb5e02ceda997f2bf8f564a3eff1a0841773ef711cd8606e79b7205173f944c29bc76a4f39f9

  • SSDEEP

    24576:gt2JTOT4PSrXodOdrGPCiwXd7mWob0NeGxUTyE3:gQFOsPSkcd6CiwX8fSBUTyE

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bk08

Decoy

chloie.net

fastingersecure.monster

foundersterrace.online

ytorly.xyz

kiralayolla.com

corporacionalpi.com

planfortheworld.com

disciplinecoaching.co.uk

rubi33.com

digitlabmedia.com

ky20033.com

h4q7.com

91ye260.xyz

coconceptevents.com

ukusizas.africa

utainnovative.africa

ted-clean.co.uk

haus-huelsche.com

ca-refund.website

football.salon

Targets

    • Target

      tmp

    • Size

      922KB

    • MD5

      b3c8c2559e752ab1fdacfbfa0578438d

    • SHA1

      b65a0bdf8d8b8ab3708fa8281d3a9e6885f5827b

    • SHA256

      bf03cd8e5554ec62c98931069f436ec71ac21d57a8922b1bb3c1958a0a9256f3

    • SHA512

      0bdec1e727359853fe84f12757adb4ca6f3a9385c92930a3acffcb5e02ceda997f2bf8f564a3eff1a0841773ef711cd8606e79b7205173f944c29bc76a4f39f9

    • SSDEEP

      24576:gt2JTOT4PSrXodOdrGPCiwXd7mWob0NeGxUTyE3:gQFOsPSkcd6CiwX8fSBUTyE

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks