General

  • Target
    04d53e21b4a416894348db44c76d079b.exe
  • Size 700KB
  • Sample230425-s9b72adb41
  • SHA256 e7c2b8fd0f30db376c2c5d18f6bdac1ee47c07c8201f70fda8c52d135d8a1b93
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • tf6p

Decoy
  • poolcleanerskingsland.com

  • nieveslandscapee.com

  • wb263.com

  • smartlubetrading.com

  • linuowen.com

  • fna-seattle.com

  • jobgenie-ai.com

  • mycocktailmind.com

  • openai-invite.com

  • tnndjf5kyxz.com

  • mclane.attorney

  • somwear.xyz

  • spliffstudios.com

  • grupofaace.com

  • wuuwo.com

  • bigtimerushcharlotte.com

  • yourercchecks.com

  • arportablepottyrentals.biz

  • sbtsanantonio.com

  • explantationsbegleitung.com

Targets

    • Target
      04d53e21b4a416894348db44c76d079b.exe
    • Size 700KB
    • SHA256 e7c2b8fd0f30db376c2c5d18f6bdac1ee47c07c8201f70fda8c52d135d8a1b93
    • MD5 SHA1 SHA512 SSDEEP
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks