General

  • Target

    2ece30c08f63f4fdc4d7326b39aa0066938163811e35d1aef6ddd2e0fada475f.exe

  • Size

    760KB

  • Sample

    240509-bpwx9sad6x

  • MD5

    91592318966139c15e0171f341882fc8

  • SHA1

    a6689f85a42ce934c3e96a9088f67c48e2e1fe83

  • SHA256

    2ece30c08f63f4fdc4d7326b39aa0066938163811e35d1aef6ddd2e0fada475f

  • SHA512

    abfd94393776b2fc7aa418f66487813a78c18b4704a3e9fd15d0ae99f9b8a28ee7dbe28edaff425a7f5a85005b324262e88a638caa098abc2f4e7fc4e8e44d99

  • SSDEEP

    12288:s8ImEuiETpbmqOwYG0JHK9Do7Uw82OpdYL445DR8jIQpOQgMUA23RzD1Kl4Ev5kR:s8I+b9CG0JHKG718izDa+x

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hd05

Decoy

businessjp6-51399.info

countyyoungpest.com

taxilasamericas.com

stairs.parts

nrgsolutions.us

cbdgirl.guru

dropshunter.net

adorabubble.co.za

alcohomeexteriors.com

aquariusbusiness.info

zaginione.com

pintoresmajadahonda.com

fursace.club

musiletras.co

carpoboutiquehotel.com

redacted.investments

symplywell.me

lezxop.xyz

stmbbill.com

1509068.cc

Targets

    • Target

      2ece30c08f63f4fdc4d7326b39aa0066938163811e35d1aef6ddd2e0fada475f.exe

    • Size

      760KB

    • MD5

      91592318966139c15e0171f341882fc8

    • SHA1

      a6689f85a42ce934c3e96a9088f67c48e2e1fe83

    • SHA256

      2ece30c08f63f4fdc4d7326b39aa0066938163811e35d1aef6ddd2e0fada475f

    • SHA512

      abfd94393776b2fc7aa418f66487813a78c18b4704a3e9fd15d0ae99f9b8a28ee7dbe28edaff425a7f5a85005b324262e88a638caa098abc2f4e7fc4e8e44d99

    • SSDEEP

      12288:s8ImEuiETpbmqOwYG0JHK9Do7Uw82OpdYL445DR8jIQpOQgMUA23RzD1Kl4Ev5kR:s8I+b9CG0JHKG718izDa+x

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Detects executables packed with SmartAssembly

    • Formbook payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks