General

  • Target

    a79e68bc2d8643ff603ce0333efb343924760abc43edcc450c124fe4b9142c75.bin

  • Size

    640KB

  • Sample

    230505-xhxrwahb5t

  • MD5

    7c4a3c01d3adebe819967127e01de983

  • SHA1

    fba186964fea7c6c3f998d041e11fea26b1821c5

  • SHA256

    a79e68bc2d8643ff603ce0333efb343924760abc43edcc450c124fe4b9142c75

  • SHA512

    32b538008a159fa01cd3823a4a0ba48bb8ec8f61ba61a1d7ad4c5116563f79c4f490c2c08fe0075f6eaf8f3c94ef6ba41c734ab226057ea1d282e18e8cf3dae6

  • SSDEEP

    12288:W5a++mu9U5W4CuYR2NycFWIR2zcw9h37e:rhOgOycFWIR2zta

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

btrd

Decoy

toulouse.gold

launchyouglobal.com

margarita-services.com

dasnail.club

casa-hilo.com

hardscapesofflorida.com

thepositivitypulse.com

kkmyanev.cfd

love6ace22.top

castorcruise.com

chch6.com

h59f07jy.cfd

saatvikteerthyatra.com

fxsecuretrading-option.com

mostbet-k1o.click

36-m.beauty

ko-or-a-news.com

eurekatextile.com

gynlkj.com

deepsouthcraftsman.com

Targets

    • Target

      a79e68bc2d8643ff603ce0333efb343924760abc43edcc450c124fe4b9142c75.bin

    • Size

      640KB

    • MD5

      7c4a3c01d3adebe819967127e01de983

    • SHA1

      fba186964fea7c6c3f998d041e11fea26b1821c5

    • SHA256

      a79e68bc2d8643ff603ce0333efb343924760abc43edcc450c124fe4b9142c75

    • SHA512

      32b538008a159fa01cd3823a4a0ba48bb8ec8f61ba61a1d7ad4c5116563f79c4f490c2c08fe0075f6eaf8f3c94ef6ba41c734ab226057ea1d282e18e8cf3dae6

    • SSDEEP

      12288:W5a++mu9U5W4CuYR2NycFWIR2zcw9h37e:rhOgOycFWIR2zta

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks