Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ConfirmBookingsexeexeexee.exe

  • Size

    762KB

  • Sample

    230709-slnwxsdg42

  • MD5

    07927aebf90098346a547f1b9686a853

  • SHA1

    05ec914f8fe8a14e37c1786307a15021555a201b

  • SHA256

    ec0778be2b035c23fb64b29a0b1480ab8e11e6bec3ddc1f6f94dab39e35fa4fb

  • SHA512

    eab2755ab89e70906edda41923afffbf47e618bbd96bbf02cea46c28abc5aeb11c091973cd7742b22a4f926f04e2bf11e06ecc3cb4afd6fba74e4fd2bdb58fe9

  • SSDEEP

    12288:SRC6DC0xnD1Ro+ma5s5jgo3JKhbITg/1lY/MLdTB42KIJ399l:irxZm/go5Cmg/0/MLk2z19

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he2a

Decoy

connectioncompass.store

zekicharge.com

dp77.shop

guninfo.guru

mamaeconomics.net

narcisme.coach

redtopassociates.com

ezezn.com

theoregondog.com

pagosmultired.online

emsculptcenterofne.com

meet-friends.online

pf326.com

wealthjigsaw.xyz

arsajib.com

kickassholdings.online

avaturre.biz

dtslogs.com

lb92.tech

pittalam.com

Targets

    • Target

      ConfirmBookingsexeexeexee.exe

    • Size

      762KB

    • MD5

      07927aebf90098346a547f1b9686a853

    • SHA1

      05ec914f8fe8a14e37c1786307a15021555a201b

    • SHA256

      ec0778be2b035c23fb64b29a0b1480ab8e11e6bec3ddc1f6f94dab39e35fa4fb

    • SHA512

      eab2755ab89e70906edda41923afffbf47e618bbd96bbf02cea46c28abc5aeb11c091973cd7742b22a4f926f04e2bf11e06ecc3cb4afd6fba74e4fd2bdb58fe9

    • SSDEEP

      12288:SRC6DC0xnD1Ro+ma5s5jgo3JKhbITg/1lY/MLdTB42KIJ399l:irxZm/go5Cmg/0/MLk2z19

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks