General

  • Target

    c6b1ba9ffe05a03d88f24ae7fe9c3543976d9c392862d4c2ca6ca2d53c4befd6.exe

  • Size

    621KB

  • Sample

    240720-n5h3kayfnq

  • MD5

    6daa7c8e19391e18c373678daaf6f1f2

  • SHA1

    f4173eea04bd72474293a1144171771bf7575578

  • SHA256

    c6b1ba9ffe05a03d88f24ae7fe9c3543976d9c392862d4c2ca6ca2d53c4befd6

  • SHA512

    96812cd74ade57ae0724e10f30399aa1d0456dbcdc12948153b0935d469b52fca23124b1281cee82e59281b2ce07ba6fb518248b14e1be3e39fee032ae347e19

  • SSDEEP

    12288:RQiuaKWgPglHRO2/IJeDp3kQHurvjA7ZT2WLJyV6YN9Z5:RDngolHg2/IJeD2QH68DoV6Y3

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hy08

Decoy

weazc.top

servoceimmpajhnuz.info

vqemkdhi.xyz

wergol.com

spa-mk.com

rtpsid88.life

tatetits.fun

raidsa.xyz

suojiansuode.net

jointhejunction.com

wudai.net

typeboot.shop

mksport-app.com

miocloud.ovh

taipan77pandan.com

wwwhg58a.com

khuahamiksai31.pro

carpedatumllc.net

safebinders.com

krx21.com

Targets

    • Target

      c6b1ba9ffe05a03d88f24ae7fe9c3543976d9c392862d4c2ca6ca2d53c4befd6.exe

    • Size

      621KB

    • MD5

      6daa7c8e19391e18c373678daaf6f1f2

    • SHA1

      f4173eea04bd72474293a1144171771bf7575578

    • SHA256

      c6b1ba9ffe05a03d88f24ae7fe9c3543976d9c392862d4c2ca6ca2d53c4befd6

    • SHA512

      96812cd74ade57ae0724e10f30399aa1d0456dbcdc12948153b0935d469b52fca23124b1281cee82e59281b2ce07ba6fb518248b14e1be3e39fee032ae347e19

    • SSDEEP

      12288:RQiuaKWgPglHRO2/IJeDp3kQHurvjA7ZT2WLJyV6YN9Z5:RDngolHg2/IJeD2QH68DoV6Y3

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks