General

  • Target

    f6ed869b733b1f2aa3bdd06040f3372a.bin

  • Size

    645KB

  • Sample

    240718-d7ccpawhrf

  • MD5

    b2931c1e82e8719e8fbf41c53202b2c4

  • SHA1

    e70b900517aa656da873b3c764d0d0acb8b36f00

  • SHA256

    9bf158493325eef78727b2115b1046a345fbefea0d14c45d801dc0504c04ec0c

  • SHA512

    72337a8e1b02f8dcd3b6d6c45b5653d4f529e2fcafb87037700ddca037a900041212015fffa80db9886277549b5963f952970b297fce56ad557614077a2911b1

  • SSDEEP

    12288:49sc9U9+DG0igP1ltskrBi8QYEoXym0vhymvvpNViTzShQiu3c9+JsDhEFy5:4iME6VBqk1HooCm0prRNVi/Sh4NsDhH5

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rn94

Decoy

st68v.xyz

conciergenotary.net

qwechaotk.top

rtpdonatoto29.xyz

8ad.xyz

powermove.top

cameras-30514.bond

vanguardcoffee.shop

umoe53fxc1bsujv.buzz

consultoriamax.net

hplxx.com

ndu.wtf

yzh478c.xyz

bigbrown999.site

xiake07.asia

resdai.xyz

the35678.shop

ba6rf.rest

ceo688.com

phimxhot.xyz

Targets

    • Target

      05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1.exe

    • Size

      1.0MB

    • MD5

      f6ed869b733b1f2aa3bdd06040f3372a

    • SHA1

      7075acf1c62e44653f5c834a14b56cd342f0ae5a

    • SHA256

      05b3ae9c167cf06edf52dc99127dfd516e24ead51e9da7d3fbf230124e7063e1

    • SHA512

      cba7753022eaa43f2d1bc77c73c7276824545e3083eee5e321f8be5b729bad3b01fe84108cbc5bdbe5fca7df1e802a55b36ef19292b1874a1cb514af5c16c582

    • SSDEEP

      24576:PAHnh+eWsN3skA4RV1Hom2KXMmHasscwkKNvvD5:yh+ZkldoPK8Yassht

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks