General

  • Target

    9b5f439bf7b59558b0b4dea2c1c387de8bd122fb2f91692030004ebeb24ab808.exe

  • Size

    1.0MB

  • Sample

    240725-fgefgasfpa

  • MD5

    fc65a875fe7b3e5e9a0fab7050c12b6b

  • SHA1

    0575feacb643c76b0e6754181a6f7620142cbe14

  • SHA256

    9b5f439bf7b59558b0b4dea2c1c387de8bd122fb2f91692030004ebeb24ab808

  • SHA512

    3e5c24e9ca8855d8f03c44e53d2d4bf9b97ad951b4c6bcd659dc7cd858e27ac0cfe601a8fccbfad56a3fab330472149e6cd443e20657a01f48d722ffd35c7765

  • SSDEEP

    24576:7AHnh+eWsN3skA4RV1Hom2KXMmHaqZQ108KTvrtsHG25:Wh+ZkldoPK8YaqZQ1084rID

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pt46

Decoy

twinportslocal.com

rovor.store

98169.club

mdywl.com

jrd3s.rest

aston1717.top

floridawoodworkingmachinery.com

17tk555t.com

ankitsho.shop

seclameh.com

realrecordlabel.com

trenchonbirmingham.com

af28.top

rtp1kenzototo.com

theselflovesite.com

promotegetpaid.info

strategiclogisticsagency.com

learneracademy.net

per-watch.com

betbox2341.com

Targets

    • Target

      9b5f439bf7b59558b0b4dea2c1c387de8bd122fb2f91692030004ebeb24ab808.exe

    • Size

      1.0MB

    • MD5

      fc65a875fe7b3e5e9a0fab7050c12b6b

    • SHA1

      0575feacb643c76b0e6754181a6f7620142cbe14

    • SHA256

      9b5f439bf7b59558b0b4dea2c1c387de8bd122fb2f91692030004ebeb24ab808

    • SHA512

      3e5c24e9ca8855d8f03c44e53d2d4bf9b97ad951b4c6bcd659dc7cd858e27ac0cfe601a8fccbfad56a3fab330472149e6cd443e20657a01f48d722ffd35c7765

    • SSDEEP

      24576:7AHnh+eWsN3skA4RV1Hom2KXMmHaqZQ108KTvrtsHG25:Wh+ZkldoPK8YaqZQ1084rID

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks