General

  • Target

    483080c26096e479fad0997bedffb6dd.bin

  • Size

    456KB

  • Sample

    240517-c7khmadh97

  • MD5

    483080c26096e479fad0997bedffb6dd

  • SHA1

    d7362052d9c1451b235075703b6c88f02d5ef71e

  • SHA256

    e16af0a74030cfbd17c2086bc1151995852fb5333949a54dfb36bc2992bb87eb

  • SHA512

    c976033a62a43766a71c7009d69d464f43f7de75db9228282467c35efcd25ec1905ff8e2c4422351edddd3ca7aa033cd62016b92a6d3ab8b45b6ec8bdb5b61fc

  • SSDEEP

    6144:Q/mPIFTMlikyqCQB+cxnQdoQsk+xi72mINsaU9h:Q0UwxyqCwFQdz+ojaU9h

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

sa

Decoy

masleyscabinetshop.com

drmarissathomas.com

alkalinewaterpurifier.com

kabluchok.com

jqm65e51.biz

hellomelmel.com

futsalfutsal.com

speedyrooftarp.com

cyberhostingnet.com

295qp.com

fais-moi-une-offre.com

maketing.today

thedevicreations.com

domuservizi.online

goldanddenim.com

oimkv4.info

benefitmanagementllc401k.com

niniiiiii.com

shortkits.com

nukamika.net

Targets

    • Target

      483080c26096e479fad0997bedffb6dd.bin

    • Size

      456KB

    • MD5

      483080c26096e479fad0997bedffb6dd

    • SHA1

      d7362052d9c1451b235075703b6c88f02d5ef71e

    • SHA256

      e16af0a74030cfbd17c2086bc1151995852fb5333949a54dfb36bc2992bb87eb

    • SHA512

      c976033a62a43766a71c7009d69d464f43f7de75db9228282467c35efcd25ec1905ff8e2c4422351edddd3ca7aa033cd62016b92a6d3ab8b45b6ec8bdb5b61fc

    • SSDEEP

      6144:Q/mPIFTMlikyqCQB+cxnQdoQsk+xi72mINsaU9h:Q0UwxyqCwFQdz+ojaU9h

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks