General

  • Target

    tmp

  • Size

    710KB

  • Sample

    230923-nj29bagf52

  • MD5

    493562fc3240d634f797be4a433d72c7

  • SHA1

    92569595aa0a20d9937bd03525a756dd35059d3b

  • SHA256

    6b73ab2cf730e26c8609e57d23e09260d6c74db84f29ae6f786129f7a3b6512b

  • SHA512

    70eb16d06d38d80cc4513962f6fbdeda54e6ec2bc30caa9fb112d3cd355b12c088426c823d3d4a3e315209b3fc908c0339e9cdc8de99462e87eba311f4801a75

  • SSDEEP

    12288:406gna2iNP1UIkvEbtOgVt3KB6bxxXRZEG/p8fD5mcjtqlg6utz5l96OXaq:XTa1F14ot1aIxxAop+mc0g6MNa

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ro12

Decoy

start399.com

decyfincoin.com

binguozhijiaok.com

one45.vip

55dy5s.top

regmt.pro

2ahxgaafifl.com

xn--6rtp2flvfc2h.com

justinmburns.com

los3.online

fleshaaikensdivinegiven7llc.com

servicedelv.services

apexcaryhomesforsale.com

shuraop.xyz

sagetotal.com

gratitude-et-compagnie.com

riderarea.com

digitalserviceact.online

contentbyc.com

agenda-digital-planner.com

Targets

    • Target

      tmp

    • Size

      710KB

    • MD5

      493562fc3240d634f797be4a433d72c7

    • SHA1

      92569595aa0a20d9937bd03525a756dd35059d3b

    • SHA256

      6b73ab2cf730e26c8609e57d23e09260d6c74db84f29ae6f786129f7a3b6512b

    • SHA512

      70eb16d06d38d80cc4513962f6fbdeda54e6ec2bc30caa9fb112d3cd355b12c088426c823d3d4a3e315209b3fc908c0339e9cdc8de99462e87eba311f4801a75

    • SSDEEP

      12288:406gna2iNP1UIkvEbtOgVt3KB6bxxXRZEG/p8fD5mcjtqlg6utz5l96OXaq:XTa1F14ot1aIxxAop+mc0g6MNa

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks