General

  • Target

    53ab34043d225c7fca168ad1a7df31a8.exe

  • Size

    1.3MB

  • Sample

    240111-y5tjeafghp

  • MD5

    53ab34043d225c7fca168ad1a7df31a8

  • SHA1

    d65e76d0c79ac6270d3136af438bc36a69c7efc2

  • SHA256

    657bd12172568c696ae02af0948808a0f9ab30d77ed199abd0f3bdf08f5d0513

  • SHA512

    4a8e212fad1cb4047b83ec70f37cc136143341fb1c14cd6cd0908c7ded887acf65135a1adc105529ebee1fe239dbfb70fd3c999c7210693af989208a27328b82

  • SSDEEP

    24576:Hg4fV76DOqfx8Dgyfx8Dg7qWpA2jPjvVpVbErWG1mwDZffL:pV76b58Dgy58Dg71A2jPjtrbtG7ZX

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

amb6

Decoy

segurocars.com

rylautosales.com

xinglinjiankang.com

dantil-brand.com

sofaloffa.club

coinclub2.com

ez-pens.com

gqtlqsw.com

robotnewswire.com

ktproductreviews.com

merchbrander.com

yesonamendmentb.com

losgatoslimos.com

kristincole.art

metalmaids.online

leftcoastmodels.com

athetheist.com

jblbusrtingsale.com

chungcugiarehcm.com

renblockchain.com

Targets

    • Target

      53ab34043d225c7fca168ad1a7df31a8.exe

    • Size

      1.3MB

    • MD5

      53ab34043d225c7fca168ad1a7df31a8

    • SHA1

      d65e76d0c79ac6270d3136af438bc36a69c7efc2

    • SHA256

      657bd12172568c696ae02af0948808a0f9ab30d77ed199abd0f3bdf08f5d0513

    • SHA512

      4a8e212fad1cb4047b83ec70f37cc136143341fb1c14cd6cd0908c7ded887acf65135a1adc105529ebee1fe239dbfb70fd3c999c7210693af989208a27328b82

    • SSDEEP

      24576:Hg4fV76DOqfx8Dgyfx8Dg7qWpA2jPjvVpVbErWG1mwDZffL:pV76b58Dgy58Dg71A2jPjtrbtG7ZX

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks