General

  • Target

    f3b8435e7359411cefb4d6c762550f4881195a2ec0cb035da5737c4b4891fb6f

  • Size

    301KB

  • Sample

    230328-hm2t3ahd96

  • MD5

    542ef4a811e2fa45e96efe1602acd737

  • SHA1

    116ae7e038b75fcee7ac7ddc33f96f981c0e81a7

  • SHA256

    f3b8435e7359411cefb4d6c762550f4881195a2ec0cb035da5737c4b4891fb6f

  • SHA512

    5fa0fd179e7fe6157aed9766281d74dedbef4ce52b287634550f3b11bd29ff08081fbc3590bd435ff6846d4018c84d2a76aa2010b220023654b873c46a6c566c

  • SSDEEP

    6144:TYa6RWpn++a1jQdqOgTSZ6i7vJYnmb7qEPDRtmfGe8C9jxIihLY2XJg:TYDWp++UEEOgmZ6uJwmb7q0DRtmfoC9s

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sa79

Decoy

aidigify.com

angelavamundson.xyz

glicotoday.fun

agencyforbuyers.com

blacklifecoachquiz.com

4e6aqw.site

huawei1990.com

diyetcay.online

chesirechefs.co.uk

generalhospitaleu.africa

hfewha.xyz

lemons2cents.com

rahilprakash.com

kave.tech

netlexfrance.net

youthexsa.africa

car-covers-40809.com

bambooactive.store

fotobugil48.com

kuhler.club

Targets

    • Target

      f3b8435e7359411cefb4d6c762550f4881195a2ec0cb035da5737c4b4891fb6f

    • Size

      301KB

    • MD5

      542ef4a811e2fa45e96efe1602acd737

    • SHA1

      116ae7e038b75fcee7ac7ddc33f96f981c0e81a7

    • SHA256

      f3b8435e7359411cefb4d6c762550f4881195a2ec0cb035da5737c4b4891fb6f

    • SHA512

      5fa0fd179e7fe6157aed9766281d74dedbef4ce52b287634550f3b11bd29ff08081fbc3590bd435ff6846d4018c84d2a76aa2010b220023654b873c46a6c566c

    • SSDEEP

      6144:TYa6RWpn++a1jQdqOgTSZ6i7vJYnmb7qEPDRtmfGe8C9jxIihLY2XJg:TYDWp++UEEOgmZ6uJwmb7q0DRtmfoC9s

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks