General

  • Target

    9312a2fd83dd825003de2272781b7e4a.bin

  • Size

    557KB

  • Sample

    230507-e8wy6aaa51

  • MD5

    0b6350f040ae12457a96d48225afaff0

  • SHA1

    9290465dcd5712c3714e20758dd7134ca46a3518

  • SHA256

    5bb6cd58a963b10180882c8cd7a43af11e3885d961b323af97a6331b63c5ed7a

  • SHA512

    d72ebaeb4b316e68991a66623f025c24e5d42546360e2ebdc14c282a3923bfd260888a5a62f4188eb2695cfda5b5225eb9af5101a22649f76cd908290311054a

  • SSDEEP

    6144:R6QEJvdsMBB38Dl+iQ+rOFTJKHBsyX6WtykgWU9nPK64fnrafmy5rxLy5lMwPgVj:FEJvjPKsJgO/KHBHTxOSeH5ElMeMBnn

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gtt8

Decoy

thesuccessbot.com

rittercivil.com

jt1.fun

d365extension.com

quqoxeq.top

visittworiverswi.com

bfprotienda.com

greenhabitsph.com

ladmere.com

clockboutiques.com

minwart.xyz

xinyuejiancai.online

eggsl.com

fetchingcandles.com

skywatiniya.com

hinkley.news

realityonlineenterprises.com

teamcroissant.com

esfera-pv.ch

herdadedosmontesbastos.com

Targets

    • Target

      7f0a83fb59c743687b2076967768f0cea1a7772390d25bcd25ebee31caeaaa8f.exe

    • Size

      643KB

    • MD5

      9312a2fd83dd825003de2272781b7e4a

    • SHA1

      f247b5a524abd633db60f6d1e332af855518ad29

    • SHA256

      7f0a83fb59c743687b2076967768f0cea1a7772390d25bcd25ebee31caeaaa8f

    • SHA512

      df53b0c0a75fa6c1c2435b93f5d1ebfd70ea720611d2f2555068df3d4b958c81b07c3e69085d4d1cb85f6ff9b57a74c339f6bdd5ef39ff96695990aca7250e08

    • SSDEEP

      6144:6ydfWo0aIYW6VQgcitOZ8ywg+8Xmf8igxXAN+BJKJmTqikXmi00FdyfrpruJMRse:NFWFFyOZ8yE7fKAN+U+g0fTprGiMTQ7

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks