General

  • Target

    841f916fd211961d16b57c00fede97127720d6d2ea52e914fa13661b1d728410

  • Size

    816KB

  • Sample

    230608-mjx4xsec36

  • MD5

    f9df3670e25d3846200606958b47c4e5

  • SHA1

    1177bfdae58c9f07f1bfc4d873a02562423c20d8

  • SHA256

    841f916fd211961d16b57c00fede97127720d6d2ea52e914fa13661b1d728410

  • SHA512

    9895e4d8bf6649838aefe23fa904d70256dac09003d4b18b1a5bda7c61896c30982828077e349810d88492ae6eacb3721ff3a82fc83975f6d8c4599c459bb6d4

  • SSDEEP

    12288:1S8hue/3H1OdvmnHKpBnM8NU1TwBiW7okCT66tk0riptH+VO8kevckNx:1BOdv8KpS8dBX7o7Fctekk

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ga36

Decoy

700kitchen.com

udda.app

fractionalgc.tech

tipmercados.net

2-upapparel.net

directbookdiscount.com

koewetzeltours.com

d7c8-iuxt.com

hamaancook.com

benjaimnmoore.com

yimaglobal.africa

dispovapo.com

aseguvenlik.com

battery-worth.com

dddanbao.mobi

blueskyauberge.com

740.mobi

betterbonella.com

liverally.club

czubao.com

Targets

    • Target

      841f916fd211961d16b57c00fede97127720d6d2ea52e914fa13661b1d728410

    • Size

      816KB

    • MD5

      f9df3670e25d3846200606958b47c4e5

    • SHA1

      1177bfdae58c9f07f1bfc4d873a02562423c20d8

    • SHA256

      841f916fd211961d16b57c00fede97127720d6d2ea52e914fa13661b1d728410

    • SHA512

      9895e4d8bf6649838aefe23fa904d70256dac09003d4b18b1a5bda7c61896c30982828077e349810d88492ae6eacb3721ff3a82fc83975f6d8c4599c459bb6d4

    • SSDEEP

      12288:1S8hue/3H1OdvmnHKpBnM8NU1TwBiW7okCT66tk0riptH+VO8kevckNx:1BOdv8KpS8dBX7o7Fctekk

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks