General

  • Target

    MalwareBazaar.11

  • Size

    675KB

  • Sample

    240718-gzwyxaxdqk

  • MD5

    033bc3249eab9a82f4238f19acd2c2f7

  • SHA1

    d0da905ae01df3db821db23eb6665ffa50bfdec1

  • SHA256

    e2fb3e62884d3e10aa6340adc488e37ffb2b15cbfe4842ff4bc7c1c83b908305

  • SHA512

    ad9594fb7b26b737a53c42f62f32e06a98a1093a85e0c720acf42c9d100b7d23132b7e4f0adfad136c5b65bbbc0fe419b943de87cd6ae9984370ab00a00ba083

  • SSDEEP

    12288:/uTDWx2PQfQmNzLP2P4MUnR2gk85pxXK1He6DsWcDF:/EawMQmNPgwc/8NwDsWcx

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hy08

Decoy

weazc.top

servoceimmpajhnuz.info

vqemkdhi.xyz

wergol.com

spa-mk.com

rtpsid88.life

tatetits.fun

raidsa.xyz

suojiansuode.net

jointhejunction.com

wudai.net

typeboot.shop

mksport-app.com

miocloud.ovh

taipan77pandan.com

wwwhg58a.com

khuahamiksai31.pro

carpedatumllc.net

safebinders.com

krx21.com

Targets

    • Target

      MalwareBazaar.11

    • Size

      675KB

    • MD5

      033bc3249eab9a82f4238f19acd2c2f7

    • SHA1

      d0da905ae01df3db821db23eb6665ffa50bfdec1

    • SHA256

      e2fb3e62884d3e10aa6340adc488e37ffb2b15cbfe4842ff4bc7c1c83b908305

    • SHA512

      ad9594fb7b26b737a53c42f62f32e06a98a1093a85e0c720acf42c9d100b7d23132b7e4f0adfad136c5b65bbbc0fe419b943de87cd6ae9984370ab00a00ba083

    • SSDEEP

      12288:/uTDWx2PQfQmNzLP2P4MUnR2gk85pxXK1He6DsWcDF:/EawMQmNPgwc/8NwDsWcx

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Blocklisted process makes network request

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks