General

  • Target

    5b5cfb978a6740c033d1339ec75af7168870baf49efe420fb1e0c31f3651ff59

  • Size

    678KB

  • Sample

    231024-e6dpssae2t

  • MD5

    6a84a8a267ef0aee60b708ea263240a7

  • SHA1

    c528f59e1f6de646a51a1027b2cb9bda72031590

  • SHA256

    5b5cfb978a6740c033d1339ec75af7168870baf49efe420fb1e0c31f3651ff59

  • SHA512

    3c0623508abe09415a62617a419cb6d16d31cad18aa2c2bbbf9934e8456592817a39c5072603cc0445a38e5ebae965b4c2ff6a02450ebb69d9d3bcbd054bfea7

  • SSDEEP

    12288:4sxTA6q5jbP3QJiBfbwfVlN3VZwgv8/VCS5Re9NN0I:7xs6+jbPrfE5wgv8AIyn0

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

o5gu

Decoy

jonathanvuportfolio.website

moneyboost.net

imikecutyou.com

toollessassembling.com

keoinfra.com

mackenziejamesphoto.com

zenovaa.com

ngmnetwork.com

odropoficial.com

huyangli.company

ganjajuice.info

promptmechanic.xyz

crispyjoy.com

dinevintageshirts.com

heyxop.online

hopefinancialmarketingph.com

weeklyvolcano.app

consultoriopmn.com

seetheratequote.com

ftds77.com

Targets

    • Target

      5b5cfb978a6740c033d1339ec75af7168870baf49efe420fb1e0c31f3651ff59

    • Size

      678KB

    • MD5

      6a84a8a267ef0aee60b708ea263240a7

    • SHA1

      c528f59e1f6de646a51a1027b2cb9bda72031590

    • SHA256

      5b5cfb978a6740c033d1339ec75af7168870baf49efe420fb1e0c31f3651ff59

    • SHA512

      3c0623508abe09415a62617a419cb6d16d31cad18aa2c2bbbf9934e8456592817a39c5072603cc0445a38e5ebae965b4c2ff6a02450ebb69d9d3bcbd054bfea7

    • SSDEEP

      12288:4sxTA6q5jbP3QJiBfbwfVlN3VZwgv8/VCS5Re9NN0I:7xs6+jbPrfE5wgv8AIyn0

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks