General

  • Target

    UAE61 - 4510793563 - ALTAHER CHEM LLC.exe

  • Size

    688KB

  • Sample

    230803-h1392sbh64

  • MD5

    5c412f0f22b162d7f32cdbc9e500a1fd

  • SHA1

    e116967f21c982cdd814d82d2d37594f5a806cce

  • SHA256

    8a6e40ffa6aabeda07bd1c75dd8566bdb498ed5ef0eb523e8371e2fecda47e36

  • SHA512

    dd7ad2c106dc1cb7da444807ef25c77da32bb8cb3fd27aaf86cd640d6873d2b0396eb2af2870c022c0387c8c85d11bc646662f3c28b152ff038b5495b360a1ef

  • SSDEEP

    12288:N5MY3kRIBx5xkUQAs371jl1INLMRUGl9zaasU:N6KkRm5BZs7p2aUGs

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ga83

Decoy

fastholdtalaric.mom

lokimusic.shop

sisucomms.xyz

techpass.net

tzyl197.com

merakibrokers.com

recargaswebdirectya.online

buzzinsourshot.net

ansuship.com

vawrs.com

osadchiy.site

bigdatacomponents.com

ssflsd.com

studiotecniconatasciafabbro.com

tiichat.com

counselingbank.com

4goodsolutions.xyz

blindajeparallantas.com

evergreenedu.xyz

dilital.com

Targets

    • Target

      UAE61 - 4510793563 - ALTAHER CHEM LLC.exe

    • Size

      688KB

    • MD5

      5c412f0f22b162d7f32cdbc9e500a1fd

    • SHA1

      e116967f21c982cdd814d82d2d37594f5a806cce

    • SHA256

      8a6e40ffa6aabeda07bd1c75dd8566bdb498ed5ef0eb523e8371e2fecda47e36

    • SHA512

      dd7ad2c106dc1cb7da444807ef25c77da32bb8cb3fd27aaf86cd640d6873d2b0396eb2af2870c022c0387c8c85d11bc646662f3c28b152ff038b5495b360a1ef

    • SSDEEP

      12288:N5MY3kRIBx5xkUQAs371jl1INLMRUGl9zaasU:N6KkRm5BZs7p2aUGs

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks