General

  • Target

    konfirmim.cmd

  • Size

    1.0MB

  • Sample

    240712-jtqk2sxbrd

  • MD5

    c9ad0db8c48595796320909adcf7a303

  • SHA1

    a9a21e3819907bba8fc0661e84fe0a7e49b4905c

  • SHA256

    909903adda36dcfc103a5260990c7ca1f47b4644672f2d94446c7e6e86f25a35

  • SHA512

    cdb375e941627757cc78f4bb1b7360b8512c4f0f3a145203b5807f7027d4a952f129f4a6367e7cbd9e0bd3613bd573eafb17e6967beb36e1039f99cb20f05f4f

  • SSDEEP

    24576:3r+gYZO1+u+KAgevoPUENFs0Y09Ea9P+Ex4yE:QRnyHp9O

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn03

Decoy

almouranipainting.com

cataloguia.shop

zaparielectric.com

whcqsc.com

ioco.in

aduredmond.com

vavada611a.fun

humtivers.com

jewellerytml.com

mcapitalparticipacoes.com

inhlcq.shop

solanamall.xyz

moviepropgroup.com

thegenesis.ltd

cyberxdefend.com

skinbykoco.com

entermintlead.com

honestaireviews.com

wyclhj7gqfustzp.buzz

w937xb.com

Targets

    • Target

      konfirmim.cmd

    • Size

      1.0MB

    • MD5

      c9ad0db8c48595796320909adcf7a303

    • SHA1

      a9a21e3819907bba8fc0661e84fe0a7e49b4905c

    • SHA256

      909903adda36dcfc103a5260990c7ca1f47b4644672f2d94446c7e6e86f25a35

    • SHA512

      cdb375e941627757cc78f4bb1b7360b8512c4f0f3a145203b5807f7027d4a952f129f4a6367e7cbd9e0bd3613bd573eafb17e6967beb36e1039f99cb20f05f4f

    • SSDEEP

      24576:3r+gYZO1+u+KAgevoPUENFs0Y09Ea9P+Ex4yE:QRnyHp9O

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks