General

  • Target

    d34b280c399cad372c9e24d996ca1d5abe72348e713a02bf5878a04a1c5d173c

  • Size

    636KB

  • Sample

    240709-e8fl6syekb

  • MD5

    024bb30767c2543753e74bb65d649495

  • SHA1

    8634b438b9d54e9847816cf5af32ab152070b264

  • SHA256

    d34b280c399cad372c9e24d996ca1d5abe72348e713a02bf5878a04a1c5d173c

  • SHA512

    be9bd40ff32b9238f714956af9aae4d19de4fa660c58db1802775c89f11a7380afe195701157a82ea57daa317ec48533797ea95fb5166ba2bed6cd8259b86798

  • SSDEEP

    12288:MtNFlpIn9JFtuo8KSl5Tx/dCNOPieoGoOEsG9Pg3c2PiiYjn:Dn9Lwo8/DJdCN43oGoOEh9PgM2PtYL

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rn94

Decoy

st68v.xyz

conciergenotary.net

qwechaotk.top

rtpdonatoto29.xyz

8ad.xyz

powermove.top

cameras-30514.bond

vanguardcoffee.shop

umoe53fxc1bsujv.buzz

consultoriamax.net

hplxx.com

ndu.wtf

yzh478c.xyz

bigbrown999.site

xiake07.asia

resdai.xyz

the35678.shop

ba6rf.rest

ceo688.com

phimxhot.xyz

Targets

    • Target

      7565e6753a23fa9393cd3a32b1f65153658a48d8a289a2571fd9285f6628ac65.exe

    • Size

      1.0MB

    • MD5

      7e65b6742284236fdd138467fad4a26b

    • SHA1

      4a98fa33b6ed4f1d79783707a44b539810973cca

    • SHA256

      7565e6753a23fa9393cd3a32b1f65153658a48d8a289a2571fd9285f6628ac65

    • SHA512

      893c639f9565836949397fc3ef20b11405313ed496d023039a5752767c1f332b3f6409d11e2e1adda99363ae6fe5f4c877717f795f706017f182265a79f8b787

    • SSDEEP

      24576:DAHnh+eWsN3skA4RV1Hom2KXMmHai5ib3XvnR3e5:Oh+ZkldoPK8Yai5knJk

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks