General

  • Target

    9d5019cef8a6bc52d94e6b4becf6249f2d202ac90204bbf508f9e62454f2f2fd

  • Size

    285KB

  • Sample

    230608-gpxgpadd4w

  • MD5

    a413d04a39c86bd0b4ca116227d20a30

  • SHA1

    0d88f2cca0aae58c31add82851c42fa1702cd4cf

  • SHA256

    9d5019cef8a6bc52d94e6b4becf6249f2d202ac90204bbf508f9e62454f2f2fd

  • SHA512

    e6d1662c7f389da0016b338185d4c4c3aae6240759641f8f8b62c07f534fbc956fa213cbd0ed37f607b67e0e38fb4635ee1031ada73c7913da921823284e3318

  • SSDEEP

    6144:36dmbMKjUztT0dAxqLjd07V8y/6+8DXDQ9NA6igSOyxRVMvM:h4AUzt0dAxq/ky+8nGig3yxRuM

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gtt8

Decoy

42taijijian.com

rehnimiyanales.com

cst247.shop

usdt09.tech

lennartjahn.com

aaabestcbd.com

marketing-digital-france-2.xyz

be4time.com

slotyfly.com

parimaladragonflywellness.life

phonereda.com

01076.win

thehoundlounge.info

high-vent.co.uk

14thfeb.com

onlyforks.info

joseeandtim.com

mylegoclub.com

iuser-findmy.info

uninassaupolopinheiro.com

Targets

    • Target

      9d5019cef8a6bc52d94e6b4becf6249f2d202ac90204bbf508f9e62454f2f2fd

    • Size

      285KB

    • MD5

      a413d04a39c86bd0b4ca116227d20a30

    • SHA1

      0d88f2cca0aae58c31add82851c42fa1702cd4cf

    • SHA256

      9d5019cef8a6bc52d94e6b4becf6249f2d202ac90204bbf508f9e62454f2f2fd

    • SHA512

      e6d1662c7f389da0016b338185d4c4c3aae6240759641f8f8b62c07f534fbc956fa213cbd0ed37f607b67e0e38fb4635ee1031ada73c7913da921823284e3318

    • SSDEEP

      6144:36dmbMKjUztT0dAxqLjd07V8y/6+8DXDQ9NA6igSOyxRVMvM:h4AUzt0dAxq/ky+8nGig3yxRuM

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Formbook payload

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks