General

  • Target

    JJUmnnkIxSCyKik.exe

  • Size

    778KB

  • Sample

    240428-kxqkwscd3y

  • MD5

    d3276b14eaab222d13f7f15dc879ed16

  • SHA1

    8d5809ae7176e28e61245b18678ef3bada66f414

  • SHA256

    864b5669f18681ae03edbd7c3b3bbf6732e55191d4883f18783eb9c611fa9a17

  • SHA512

    9a552073cb2f81f6b623f20bc388a68a1c1e5fe79198ae5c59a9548e5228db408e263bc3f57ac8a915e7971df41be5a1f6588b225ac5fdf6500bb5f58086ac52

  • SSDEEP

    24576:AHPjKr5BNDoxwj4R0zyfx+VC6vkI8F4WSI+y9:6k5BNYSNq6vcI8FQW

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

be03

Decoy

458q14v4ams2.com

priceoctopus.com

betinplay.xyz

bcnd.xyz

1510soliveavenue.com

mcdpropertypros.com

reddcrownexpress.com

rewardlabs.shop

burenbrand.com

revand.io

tractionendurancecoaching.com

jotaerreshopp.com

shopboyg.com

dakor.shop

groundswellmag.life

nehagadodia.com

dancarellibizbroker.com

meconline.co

ttmq.cc

thegoldenyouph.com

Targets

    • Target

      JJUmnnkIxSCyKik.exe

    • Size

      778KB

    • MD5

      d3276b14eaab222d13f7f15dc879ed16

    • SHA1

      8d5809ae7176e28e61245b18678ef3bada66f414

    • SHA256

      864b5669f18681ae03edbd7c3b3bbf6732e55191d4883f18783eb9c611fa9a17

    • SHA512

      9a552073cb2f81f6b623f20bc388a68a1c1e5fe79198ae5c59a9548e5228db408e263bc3f57ac8a915e7971df41be5a1f6588b225ac5fdf6500bb5f58086ac52

    • SSDEEP

      24576:AHPjKr5BNDoxwj4R0zyfx+VC6vkI8F4WSI+y9:6k5BNYSNq6vcI8FQW

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks