General

  • Target

    fileANS.exe

  • Size

    1.0MB

  • Sample

    240514-j4earsgc9z

  • MD5

    15457d011dab88622087b56142ee22d3

  • SHA1

    1fc14c22eb559ae15e0642ed913aa1b93d6f3312

  • SHA256

    3ffcd95cd6bd717e4371107605cdb847891190eae063dcf741dbae9bd1528faf

  • SHA512

    314aa3fc23f86dedffce5143c447e8e2c0e92928abf68021c487dacf006181bd11a44468724fd8592c04024decfa1308657f971172f795b745cbad9e0cf91566

  • SSDEEP

    24576:YAHnh+eWsN3skA4RV1Hom2KXMmHawvDvPYknWte5:fh+ZkldoPK8YawrXYaWu

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ba94

Decoy

dxtra.shop

upfromhere-eventsdecor.com

blacksevenkoeln.shop

pcboards2024.xyz

posteo.lol

naservus.com

pivotance.com

90ans.com

ebenezer-remodeling.com

reddragondao.com

gspotshop.com

thesiamesebetta.biz

rrdhq.com

greenislandservices.info

prismotrov.com

elaqbh.shop

sosenfantscovidlong.com

elmsolarsavings.com

sol-casino-2023.club

sharecroipper.top

Targets

    • Target

      fileANS.exe

    • Size

      1.0MB

    • MD5

      15457d011dab88622087b56142ee22d3

    • SHA1

      1fc14c22eb559ae15e0642ed913aa1b93d6f3312

    • SHA256

      3ffcd95cd6bd717e4371107605cdb847891190eae063dcf741dbae9bd1528faf

    • SHA512

      314aa3fc23f86dedffce5143c447e8e2c0e92928abf68021c487dacf006181bd11a44468724fd8592c04024decfa1308657f971172f795b745cbad9e0cf91566

    • SSDEEP

      24576:YAHnh+eWsN3skA4RV1Hom2KXMmHawvDvPYknWte5:fh+ZkldoPK8YawrXYaWu

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks