General

  • Target

    Comprobante de pago INT_EMP221226 20230320_$2763320.exe.malz

  • Size

    1.1MB

  • Sample

    230321-wr9x5acd48

  • MD5

    12411b3710982c190df4993dfe2e3761

  • SHA1

    c66d8a7b15ed34380fde79e4cd2892f934e4b8bc

  • SHA256

    6fef888e6f662744463a37949ee1df183c279e42baf355319484293748ded41b

  • SHA512

    386a3e3036cd2317aaf1b984c13a49d1d678c82c46de9f2001aa4243892ebc330b6005a2490a3683efbf3d686bfee350c4afa1ea2851b86f3b52079bebc57ab2

  • SSDEEP

    24576:4qIRuN3c+/weL3uzxKPH1BYBWLv6QT6JdrD:4HRuNMqwYuzxKPfYIj6QGJdr

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jr22

Decoy

941zhe.com

lunarportal.space

xn--osmaniyeiek-t9ab.online

trejoscar.com

nrnursery.com

quizcannot.cfd

seedstockersthailand.com

watsonwindow.com

wjfholdings.com

weziclondon.com

naruot.xyz

yeji.plus

classicmenstore.com

oharatravel.com

therapyplankits.com

keviegreshonpt.com

qdlyner.com

seithupaarungal.com

casinorates.online

8ug4as.icu

Targets

    • Target

      Comprobante de pago INT_EMP221226 20230320_$2763320.exe.malz

    • Size

      1.1MB

    • MD5

      12411b3710982c190df4993dfe2e3761

    • SHA1

      c66d8a7b15ed34380fde79e4cd2892f934e4b8bc

    • SHA256

      6fef888e6f662744463a37949ee1df183c279e42baf355319484293748ded41b

    • SHA512

      386a3e3036cd2317aaf1b984c13a49d1d678c82c46de9f2001aa4243892ebc330b6005a2490a3683efbf3d686bfee350c4afa1ea2851b86f3b52079bebc57ab2

    • SSDEEP

      24576:4qIRuN3c+/weL3uzxKPH1BYBWLv6QT6JdrD:4HRuNMqwYuzxKPfYIj6QGJdr

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks