General

  • Target

    BBK987866767899.exe

  • Size

    792KB

  • Sample

    240119-rcj1yafhh3

  • MD5

    6f5d737532ce8f20246b98b439168fc4

  • SHA1

    f2066b5bc181c2e5788a23c5b335f2045a5c4d07

  • SHA256

    ec7f9e26c253ba9024ad8baf255778a3ee3055cc0f834be9e77a41e80d49e9e0

  • SHA512

    2bd40442fc05779e767ae5f65e9a5234b447dc33d0509790ca540a04deadf059bc3bab7e09ddfa41bd37388c721aa90b596444a421665c9e5fd73a76259276bc

  • SSDEEP

    12288:zt0r6klnaP5oE/kbQRgp16XR0oBtFR7ke+Dp:z6r6mHTbSw16XTffkZp

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he2a

Decoy

connectioncompass.store

zekicharge.com

dp77.shop

guninfo.guru

mamaeconomics.net

narcisme.coach

redtopassociates.com

ezezn.com

theoregondog.com

pagosmultired.online

emsculptcenterofne.com

meet-friends.online

pf326.com

wealthjigsaw.xyz

arsajib.com

kickassholdings.online

avaturre.biz

dtslogs.com

lb92.tech

pittalam.com

Targets

    • Target

      BBK987866767899.exe

    • Size

      792KB

    • MD5

      6f5d737532ce8f20246b98b439168fc4

    • SHA1

      f2066b5bc181c2e5788a23c5b335f2045a5c4d07

    • SHA256

      ec7f9e26c253ba9024ad8baf255778a3ee3055cc0f834be9e77a41e80d49e9e0

    • SHA512

      2bd40442fc05779e767ae5f65e9a5234b447dc33d0509790ca540a04deadf059bc3bab7e09ddfa41bd37388c721aa90b596444a421665c9e5fd73a76259276bc

    • SSDEEP

      12288:zt0r6klnaP5oE/kbQRgp16XR0oBtFR7ke+Dp:z6r6mHTbSw16XTffkZp

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks