General

  • Target

    b362ced287b5f00b3b2ab2c3a7bbc85b57e13271d76a6c65423a831fde92876c.exe

  • Size

    636KB

  • Sample

    240718-xx52sssdql

  • MD5

    66645c931f0efe0978e4e6f3a208355a

  • SHA1

    a8d4f42410e8c03afbe6edff9fb7515811590f7f

  • SHA256

    b362ced287b5f00b3b2ab2c3a7bbc85b57e13271d76a6c65423a831fde92876c

  • SHA512

    7ee22cbc3f80cf079a47fc6c1aff047e3c48106b8b800163227be0d2bb1530654876503947ab75e44b2bcd0a89e89261c9e85c329e46d8f19ec3375e4e9a852e

  • SSDEEP

    12288:O5bmfm3V8eY73Sv9+Vcfx4sWo7FxpLq0ubuIKOTeh2AQdRlF6U:IQ73a9+Vcl7FxpG0dhqemRv6U

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

v15n

Decoy

dyahwoahjuk.store

toysstorm.com

y7rak9.com

2222233p6.shop

betbox2341.com

visualvarta.com

nijssenadventures.com

main-12.site

leng4d.net

kurainu.xyz

hatesa.xyz

culturamosaica.com

supermallify.store

gigboard.app

rxforgive.com

ameliestones.com

kapalwin.live

tier.credit

sobol-ksa.com

faredeal.online

Targets

    • Target

      b362ced287b5f00b3b2ab2c3a7bbc85b57e13271d76a6c65423a831fde92876c.exe

    • Size

      636KB

    • MD5

      66645c931f0efe0978e4e6f3a208355a

    • SHA1

      a8d4f42410e8c03afbe6edff9fb7515811590f7f

    • SHA256

      b362ced287b5f00b3b2ab2c3a7bbc85b57e13271d76a6c65423a831fde92876c

    • SHA512

      7ee22cbc3f80cf079a47fc6c1aff047e3c48106b8b800163227be0d2bb1530654876503947ab75e44b2bcd0a89e89261c9e85c329e46d8f19ec3375e4e9a852e

    • SSDEEP

      12288:O5bmfm3V8eY73Sv9+Vcfx4sWo7FxpLq0ubuIKOTeh2AQdRlF6U:IQ73a9+Vcl7FxpG0dhqemRv6U

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks