General

  • Target
    48147474eaef88b0ba2927745819466064ba02897a21fb1f7a4022edc1bcb8da.zip
  • Size 693KB
  • Sample240622-bjrflatfkp
  • SHA256 48147474eaef88b0ba2927745819466064ba02897a21fb1f7a4022edc1bcb8da
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • formbook

Version
  • 4.1

Campaign
  • ty31

Decoy
  • jejakunik.com

  • inb319.com

  • jifsjn.buzz

  • gkyukon.site

  • 43443.cfd

  • cogil69id.com

  • oeaog.com

  • lpgatm.com

  • mymarketsales.com

  • tomclk.icu

  • 404417.online

  • nysconstruction.com

  • ourwisequote.com

  • ahsanadvisory.com

  • ottawaherps.com

  • forevermust.com

  • apartments-for-rent-47679.bond

  • kdasjijaksdd.icu

  • buthaynah.com

  • manggungjayakanopi.com

Targets

    • Target
      MV Starship.exe
    • Size 1.1MB
    • SHA256 3cc81b7a9a59609e3267d06fad726352660b7c2e5c896c193939aff4744d499d
    • MD5 SHA1 SHA512 SSDEEP
    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks