Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    obizx.exe

  • Size

    605KB

  • Sample

    230802-g26wwsdb75

  • MD5

    745174884165278ca284212180544a17

  • SHA1

    920d5344b51f4f97cd92230e85c339c2237aaf1f

  • SHA256

    2e43e75303476b0eff6585680ad006cc7a7506a4564aa49504512ee3b6621884

  • SHA512

    b27d88282d10f6ecb0de600c4800e8b07f97a7348f47ee996cd205a1a84e5beafdbe4c6f4e589aceb56261c85c0dc95108c3fdb88cfcbc1077daadde7bca0d80

  • SSDEEP

    12288:mg7JYihlZ/dMkbGo4suHNmS3cgexJAY7ytxcFmRCkn8RWpaxOXskry:mg7CClxek9huHNi1JAY72xr4kqW8xOXB

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

oy30

Decoy

rfc234.top

danielcavalari.com

elperegrinocabo.com

aryor.info

surelistening.com

premium-numero-telf.buzz

orlynyml.click

tennislovers-ro.com

holdmytracker.com

eewapay.com

jaimesinstallglass.com

damactrade.net

swapspecialities.com

perfumesrffd.today

salesfactory.pro

supportive-solutions.com

naiol.com

khoyr.com

kalendeargpt44.com

web-tech-spb.store

Targets

    • Target

      obizx.exe

    • Size

      605KB

    • MD5

      745174884165278ca284212180544a17

    • SHA1

      920d5344b51f4f97cd92230e85c339c2237aaf1f

    • SHA256

      2e43e75303476b0eff6585680ad006cc7a7506a4564aa49504512ee3b6621884

    • SHA512

      b27d88282d10f6ecb0de600c4800e8b07f97a7348f47ee996cd205a1a84e5beafdbe4c6f4e589aceb56261c85c0dc95108c3fdb88cfcbc1077daadde7bca0d80

    • SSDEEP

      12288:mg7JYihlZ/dMkbGo4suHNmS3cgexJAY7ytxcFmRCkn8RWpaxOXskry:mg7CClxek9huHNi1JAY72xr4kqW8xOXB

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks