General

  • Target

    4f3beb04e0d4713530c2f9c369c300186ab01d902f060a904e5648490e8ba708.bin

  • Size

    572KB

  • Sample

    230501-ty1xpaef91

  • MD5

    5e00fa6a5295e6453759335ecaf99eb1

  • SHA1

    8f5e96b5a91021e4b76c75f399a1954a0c8a575a

  • SHA256

    4f3beb04e0d4713530c2f9c369c300186ab01d902f060a904e5648490e8ba708

  • SHA512

    eb4aaf711e76904de06a2c220d2a70a6cf46e3fda79179989f1c37428b7eaea0e97fcb9f7f3cc0644f00e8d20741347215724222a1d227415fe895606802a3dd

  • SSDEEP

    12288:Y9AaG7JIuCQHFx57KqoUYxBU5nnN5cM3tgnH:Y9Az1IjE5eDUYj2be

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gtt8

Decoy

thesuccessbot.com

rittercivil.com

jt1.fun

d365extension.com

quqoxeq.top

visittworiverswi.com

bfprotienda.com

greenhabitsph.com

ladmere.com

clockboutiques.com

minwart.xyz

xinyuejiancai.online

eggsl.com

fetchingcandles.com

skywatiniya.com

hinkley.news

realityonlineenterprises.com

teamcroissant.com

esfera-pv.ch

herdadedosmontesbastos.com

Targets

    • Target

      4f3beb04e0d4713530c2f9c369c300186ab01d902f060a904e5648490e8ba708.bin

    • Size

      572KB

    • MD5

      5e00fa6a5295e6453759335ecaf99eb1

    • SHA1

      8f5e96b5a91021e4b76c75f399a1954a0c8a575a

    • SHA256

      4f3beb04e0d4713530c2f9c369c300186ab01d902f060a904e5648490e8ba708

    • SHA512

      eb4aaf711e76904de06a2c220d2a70a6cf46e3fda79179989f1c37428b7eaea0e97fcb9f7f3cc0644f00e8d20741347215724222a1d227415fe895606802a3dd

    • SSDEEP

      12288:Y9AaG7JIuCQHFx57KqoUYxBU5nnN5cM3tgnH:Y9Az1IjE5eDUYj2be

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks