Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    doc#230928330.exe

  • Size

    688KB

  • Sample

    231011-hyv6nabb35

  • MD5

    733e39b98b5d9e34afd5feba60e74566

  • SHA1

    33b76f208403ff4a41de8c0b59edf02ead600843

  • SHA256

    3776d991080dd8cdf41d7b64315d1bccf2c09ed001058b9a28042d760f888163

  • SHA512

    e7a82d2ba88f93b395b53bff19b2b6b32617639cc731a04d2ee57d9b33cfd1e18a42d4d1ed99fdf5d6967d43438b7f354299a762bcd033a0e95174ac8c07d2af

  • SSDEEP

    12288:EuRr/TP5WypE15ZP5Lt35w2VM4k6yONHFs:Eu9/j0ypE15ZP5Lt35w2VM9ODs

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sn26

Decoy

resenha10.bet

gulshan-rajput.com

xbus.tech

z813my.cfd

wlxzjlny.cfd

auntengotiempo.com

canada-reservation.com

thegiftcompany.shop

esthersilveirapropiedades.com

1wapws.top

ymjblnvo.cfd

termokimik.net

kushiro-artist-school.com

bmmboo.com

caceresconstructionservices.com

kentuckywalkabout.com

bringyourcart.com

miamiwinetour.com

bobcatsocial.site

thirdmind.network

Targets

    • Target

      doc#230928330.exe

    • Size

      688KB

    • MD5

      733e39b98b5d9e34afd5feba60e74566

    • SHA1

      33b76f208403ff4a41de8c0b59edf02ead600843

    • SHA256

      3776d991080dd8cdf41d7b64315d1bccf2c09ed001058b9a28042d760f888163

    • SHA512

      e7a82d2ba88f93b395b53bff19b2b6b32617639cc731a04d2ee57d9b33cfd1e18a42d4d1ed99fdf5d6967d43438b7f354299a762bcd033a0e95174ac8c07d2af

    • SSDEEP

      12288:EuRr/TP5WypE15ZP5Lt35w2VM4k6yONHFs:Eu9/j0ypE15ZP5Lt35w2VM9ODs

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks