General

  • Target

    62267cac33411772b3b17521d02bf895864f7e6a1e199f6706d24fba6036e081

  • Size

    692KB

  • Sample

    231106-t8qjpseb28

  • MD5

    8311a1beb1bde04ce733fba1f436bad6

  • SHA1

    f97884744eeb90340d7ec74d83b43c1c7142b00d

  • SHA256

    62267cac33411772b3b17521d02bf895864f7e6a1e199f6706d24fba6036e081

  • SHA512

    9a2f6393f65389b6e6c7a1f41d2be6e62746f616df82f3caeeb39956db61d2ebbd63959f084fc7c838ca63e593271cd877805cac02beaa80c77154b73c127819

  • SSDEEP

    12288:3RFk2rLWXJXGPqRTGqeuLfGlnBdNy+PDk8adg81jzIKSZdHEN8IADQ42g2YG:9C52SRTGqeu6tI4/qg8qKSZpENDWQG

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

o5gu

Decoy

jonathanvuportfolio.website

moneyboost.net

imikecutyou.com

toollessassembling.com

keoinfra.com

mackenziejamesphoto.com

zenovaa.com

ngmnetwork.com

odropoficial.com

huyangli.company

ganjajuice.info

promptmechanic.xyz

crispyjoy.com

dinevintageshirts.com

heyxop.online

hopefinancialmarketingph.com

weeklyvolcano.app

consultoriopmn.com

seetheratequote.com

ftds77.com

Targets

    • Target

      62267cac33411772b3b17521d02bf895864f7e6a1e199f6706d24fba6036e081

    • Size

      692KB

    • MD5

      8311a1beb1bde04ce733fba1f436bad6

    • SHA1

      f97884744eeb90340d7ec74d83b43c1c7142b00d

    • SHA256

      62267cac33411772b3b17521d02bf895864f7e6a1e199f6706d24fba6036e081

    • SHA512

      9a2f6393f65389b6e6c7a1f41d2be6e62746f616df82f3caeeb39956db61d2ebbd63959f084fc7c838ca63e593271cd877805cac02beaa80c77154b73c127819

    • SSDEEP

      12288:3RFk2rLWXJXGPqRTGqeuLfGlnBdNy+PDk8adg81jzIKSZdHEN8IADQ42g2YG:9C52SRTGqeu6tI4/qg8qKSZpENDWQG

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks