General

  • Target

    8011db3227aaeb4d7bc937c2a4946ca62c4661baba72957904432600b0abe4b1.bin

  • Size

    650KB

  • Sample

    230507-efppdaec9y

  • MD5

    32dd6dbfa639a0ec681086517c1fc59a

  • SHA1

    27d0d764ea87271375aadba7b10b83c613b15f5d

  • SHA256

    8011db3227aaeb4d7bc937c2a4946ca62c4661baba72957904432600b0abe4b1

  • SHA512

    65ca1971511115f98b0fc567141af3c7c57db7b4c180cce57512beb84b6d83b0e846ca177d96a1e94d4fed409b6d677577b56a07edb14521caf338974d5bfaef

  • SSDEEP

    12288:wAcAegQVtjQVbwPoOKbbZGcWX9AyIdlzRzAJtWm6LvaTjLIpxf:wJ8V9ZGcWX2XlVmWETHIp

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gtt8

Decoy

thesuccessbot.com

rittercivil.com

jt1.fun

d365extension.com

quqoxeq.top

visittworiverswi.com

bfprotienda.com

greenhabitsph.com

ladmere.com

clockboutiques.com

minwart.xyz

xinyuejiancai.online

eggsl.com

fetchingcandles.com

skywatiniya.com

hinkley.news

realityonlineenterprises.com

teamcroissant.com

esfera-pv.ch

herdadedosmontesbastos.com

Targets

    • Target

      8011db3227aaeb4d7bc937c2a4946ca62c4661baba72957904432600b0abe4b1.bin

    • Size

      650KB

    • MD5

      32dd6dbfa639a0ec681086517c1fc59a

    • SHA1

      27d0d764ea87271375aadba7b10b83c613b15f5d

    • SHA256

      8011db3227aaeb4d7bc937c2a4946ca62c4661baba72957904432600b0abe4b1

    • SHA512

      65ca1971511115f98b0fc567141af3c7c57db7b4c180cce57512beb84b6d83b0e846ca177d96a1e94d4fed409b6d677577b56a07edb14521caf338974d5bfaef

    • SSDEEP

      12288:wAcAegQVtjQVbwPoOKbbZGcWX9AyIdlzRzAJtWm6LvaTjLIpxf:wJ8V9ZGcWX2XlVmWETHIp

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks