General

  • Target

    96c283a9edad7bf16f772d34c7b137d5403be1dbc96589f7d57d71a0fd89c02f

  • Size

    678KB

  • Sample

    230507-fdqdkaha86

  • MD5

    6d232ced9542d40c282a4b5f068354dc

  • SHA1

    26bd195bd2a9284660dbd77d698a9834492b7b01

  • SHA256

    96c283a9edad7bf16f772d34c7b137d5403be1dbc96589f7d57d71a0fd89c02f

  • SHA512

    9c355996a59ada63b7dc469b865569dc38a60838acd7e62b351b1771eb10e0378d77f2ace82af0fd7453a3edffabe4b4654ffbb458172381b8fada29fd685e3f

  • SSDEEP

    12288:6dFmTcMN5ibdArg67c+CIceHD8BKuifk7jWcLc:6dF3YIi0nkuiQKc

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gtt8

Decoy

thesuccessbot.com

rittercivil.com

jt1.fun

d365extension.com

quqoxeq.top

visittworiverswi.com

bfprotienda.com

greenhabitsph.com

ladmere.com

clockboutiques.com

minwart.xyz

xinyuejiancai.online

eggsl.com

fetchingcandles.com

skywatiniya.com

hinkley.news

realityonlineenterprises.com

teamcroissant.com

esfera-pv.ch

herdadedosmontesbastos.com

Targets

    • Target

      96c283a9edad7bf16f772d34c7b137d5403be1dbc96589f7d57d71a0fd89c02f

    • Size

      678KB

    • MD5

      6d232ced9542d40c282a4b5f068354dc

    • SHA1

      26bd195bd2a9284660dbd77d698a9834492b7b01

    • SHA256

      96c283a9edad7bf16f772d34c7b137d5403be1dbc96589f7d57d71a0fd89c02f

    • SHA512

      9c355996a59ada63b7dc469b865569dc38a60838acd7e62b351b1771eb10e0378d77f2ace82af0fd7453a3edffabe4b4654ffbb458172381b8fada29fd685e3f

    • SSDEEP

      12288:6dFmTcMN5ibdArg67c+CIceHD8BKuifk7jWcLc:6dF3YIi0nkuiQKc

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks