General

  • Target

    354bb2d5a03e3c1d041730e3478e80ab5a264fd852e146e880834a346fc63579.zip

  • Size

    400KB

  • Sample

    231022-vksvlabc5x

  • MD5

    1acd761e68f2d31eb821578b9d2eb9a6

  • SHA1

    63c70302562646ff198feae1530c3abab4ae9b01

  • SHA256

    9b4b7c60d97f1cf3a967a9607b78f851aa308c53cb409ebdeaad182f9da562f0

  • SHA512

    9df4f52c5f757f4473f2e31c888e1f7b5bd2a195976625d99dda4ee534ff08c95136c289794d2e4fa0760242b39350e05daf0c2df587b0ec2c02d238fbb1cf6a

  • SSDEEP

    12288:aFe+J9Oq8igdpW0kBZUfh6zpfUn8pG5YbG1txa:n+J9Oq8NkBZUohp7J

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sy22

Decoy

vinteligencia.com

displayfridges.fun

completetip.com

giallozafferrano.com

jizihao1.com

mysticheightstrail.com

fourseasonslb.com

kjnala.shop

mosiacwall.com

vandistreet.com

gracefullytouchedartistry.com

hbiwhwr.shop

mfmz.net

hrmbrillianz.com

funwarsztat.com

polewithcandy.com

ourrajasthan.com

wilhouettteamerica.com

johnnystintshop.com

asgnelwin.com

Targets

    • Target

      354bb2d5a03e3c1d041730e3478e80ab5a264fd852e146e880834a346fc63579.exe

    • Size

      426KB

    • MD5

      df247bbfaf91dbe0da4d79a04cfb5ca3

    • SHA1

      0d29cbfa4b746e71c680bbd56a6c51964fd9b1fa

    • SHA256

      354bb2d5a03e3c1d041730e3478e80ab5a264fd852e146e880834a346fc63579

    • SHA512

      ea413b9f389b9bb2bd8eaca5c3917a656840df5d48c5fb5478d9b453412fe941229cae535df587a66996acb9b96a4c692491ebe65a106d35eb0b757d6412286b

    • SSDEEP

      6144:zfL+oqgoT3oPrD68F2PD44p8Ls1k7n82iKGI3TmBp6CbspK7M2jtsftCq9CPbz:zfLCT21oy82PGIC/Bb8K7MNCB/

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks