General

  • Target

    976e8708033d7458ec6750d858fc6d49093024a2c683e038c55dc45c07cc1912.bin

  • Size

    771KB

  • Sample

    230507-fenw5aah2v

  • MD5

    deb6fe5dfa8afada9f15483627b65051

  • SHA1

    e62c1b8aa4784d841ae27ad0a9579af9b455596a

  • SHA256

    976e8708033d7458ec6750d858fc6d49093024a2c683e038c55dc45c07cc1912

  • SHA512

    55ede9409fcdc0df600bc5265dec2d133c64dfdbf859232c6c95fa67498f8fa47141e86625e43a98df7cd423bb96a21471cf09a2306773372df0d4ff7b03d7c0

  • SSDEEP

    12288:rv89ZSEOhePpriGwJbgbnoZR9fe98FPMU9QQYF:TkXOQu6bn2ne98FPB9B

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gtt8

Decoy

thesuccessbot.com

rittercivil.com

jt1.fun

d365extension.com

quqoxeq.top

visittworiverswi.com

bfprotienda.com

greenhabitsph.com

ladmere.com

clockboutiques.com

minwart.xyz

xinyuejiancai.online

eggsl.com

fetchingcandles.com

skywatiniya.com

hinkley.news

realityonlineenterprises.com

teamcroissant.com

esfera-pv.ch

herdadedosmontesbastos.com

Targets

    • Target

      976e8708033d7458ec6750d858fc6d49093024a2c683e038c55dc45c07cc1912.bin

    • Size

      771KB

    • MD5

      deb6fe5dfa8afada9f15483627b65051

    • SHA1

      e62c1b8aa4784d841ae27ad0a9579af9b455596a

    • SHA256

      976e8708033d7458ec6750d858fc6d49093024a2c683e038c55dc45c07cc1912

    • SHA512

      55ede9409fcdc0df600bc5265dec2d133c64dfdbf859232c6c95fa67498f8fa47141e86625e43a98df7cd423bb96a21471cf09a2306773372df0d4ff7b03d7c0

    • SSDEEP

      12288:rv89ZSEOhePpriGwJbgbnoZR9fe98FPMU9QQYF:TkXOQu6bn2ne98FPB9B

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks