General

  • Target

    d47eb4bff603d2015f8dc6512a51e8b37e42c53d7760ceb0bcf34ea875200d14

  • Size

    815KB

  • Sample

    230327-mtm2psfb6y

  • MD5

    629b9eb152895dffb0f20875ef095662

  • SHA1

    621d9d0399b6ac2dd78cc82ff86df2a4ff8ada73

  • SHA256

    d47eb4bff603d2015f8dc6512a51e8b37e42c53d7760ceb0bcf34ea875200d14

  • SHA512

    49653756030145d41ebe40ff2f8da011251cdf847e72896ff5cfb4d60a15ad1b17a36f071ca1d5e0b0b08501b421b9e594f51b8a3bca8addde83427b56996a8b

  • SSDEEP

    12288:CA5sB0OIZ043Ws3yD/laH3lDhrBbFJeXGSFmwhUq9Nj4ilJhZ:CA5Em+43jW/laHdhJeXGIUq9Nj4iDD

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dr62

Decoy

juanbrujo.com

toptasker.africa

g-labs.one

1redbuckpermonth.com

lasolutions.online

beginagainmen.com

iearn.site

leading-car.ru

codigosindiabetes.fun

6y8ud.bond

fptmarket.shop

ctjhxv3.vip

huluxia2.xyz

piggg08.uk

kms-pico-tools.com

westonandcate.com

giftrendz.com

kqwdhrendfywefdst.top

anchitchoudhary.com

sistemodasi.net

Targets

    • Target

      d47eb4bff603d2015f8dc6512a51e8b37e42c53d7760ceb0bcf34ea875200d14

    • Size

      815KB

    • MD5

      629b9eb152895dffb0f20875ef095662

    • SHA1

      621d9d0399b6ac2dd78cc82ff86df2a4ff8ada73

    • SHA256

      d47eb4bff603d2015f8dc6512a51e8b37e42c53d7760ceb0bcf34ea875200d14

    • SHA512

      49653756030145d41ebe40ff2f8da011251cdf847e72896ff5cfb4d60a15ad1b17a36f071ca1d5e0b0b08501b421b9e594f51b8a3bca8addde83427b56996a8b

    • SSDEEP

      12288:CA5sB0OIZ043Ws3yD/laH3lDhrBbFJeXGSFmwhUq9Nj4ilJhZ:CA5Em+43jW/laHdhJeXGIUq9Nj4iDD

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks