General

  • Target

    2b68e5d464030eb75cf019b4a2c56b19.bin

  • Size

    529KB

  • Sample

    231011-pv5dgsaa64

  • MD5

    1d54b5cc611d199b36c265fd032bb254

  • SHA1

    5543593d961a0fa53b1fd7b02fe89ac3b1796bd7

  • SHA256

    14d40878a001875eef6dec9b9f63b995306eeb9fc9ac111ac69d97f933f9fd7e

  • SHA512

    3d55aa7915eb8335af02a35a40ac7fc8a1616298138409f103bca42e10e6d00b1c947330974031e24283b620e3a04e8968fd2194b3d3df6fe6e1a36b2d6887d9

  • SSDEEP

    12288:D3m49TKNHRYmxBbUPYmaylxrFyoWx1A0ghdyVJiEvwzQf9EDx1Y:TheZRYmxBg+yltI15gLyHiiwP8

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ey16

Decoy

slimshotonline.com

rifaboa.com

metallzauber.com

jabandfuel.com

reacthat.com

qcgaeu.top

ssongg446.cfd

29kuan7.cfd

101agh.com

reliablii.com

luginfinity.com

e513.cloud

k4lantar.sbs

etoempire.com

phons.info

vovacom.com

birbakalim.fun

wellhousesctx.com

flthg.link

strasburgangus.com

Targets

    • Target

      #PO 4500515595 ULTRA TEC.exe

    • Size

      550KB

    • MD5

      5adbfe3a05eb61b2d2620b6538dc5772

    • SHA1

      8bee7a099e2c1753a62be196915da3756758e75c

    • SHA256

      d404e5865cddbf47f6a494f9120130035b3ac5761810dc75e20bc28873327547

    • SHA512

      5d66a876e199a1733c9c445cdb5d2c4d4842373a710c6a93c088d1d5456ef7c6a3308a56b1b00c5852457ec8db8108b1fe278f45b0dcc7b7433ea20b9e4a465c

    • SSDEEP

      12288:JZ725ZbHWLBajVyuexPgAHsP3o4roF6Btp3P:uCQSxPgAIogPBth

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks