General

  • Target

    d2a39b14a5228cf9cbaa0535645985cccc4bf04328e4de0592483b06b623242e.exe

  • Size

    1.1MB

  • Sample

    240725-gvxdwawbjb

  • MD5

    9380ff9d02e287f2e8695281d49503f2

  • SHA1

    9a8549011e0c8a68f271cf12a7390ddf37416a62

  • SHA256

    d2a39b14a5228cf9cbaa0535645985cccc4bf04328e4de0592483b06b623242e

  • SHA512

    382d7c4a51d2e9566a2577e08ab5624056ce872ac8ede42812059601985415326fb0ea2c304fb09f908484b1dbba18b91121982520ef882618bdde7169fcff6c

  • SSDEEP

    24576:FqDEvCTbMWu7rQYlBQcBiT6rprG8afw1YisS/6dL:FTvC/MTQYxsWR7afDiqd

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pt46

Decoy

twinportslocal.com

rovor.store

98169.club

mdywl.com

jrd3s.rest

aston1717.top

floridawoodworkingmachinery.com

17tk555t.com

ankitsho.shop

seclameh.com

realrecordlabel.com

trenchonbirmingham.com

af28.top

rtp1kenzototo.com

theselflovesite.com

promotegetpaid.info

strategiclogisticsagency.com

learneracademy.net

per-watch.com

betbox2341.com

Targets

    • Target

      d2a39b14a5228cf9cbaa0535645985cccc4bf04328e4de0592483b06b623242e.exe

    • Size

      1.1MB

    • MD5

      9380ff9d02e287f2e8695281d49503f2

    • SHA1

      9a8549011e0c8a68f271cf12a7390ddf37416a62

    • SHA256

      d2a39b14a5228cf9cbaa0535645985cccc4bf04328e4de0592483b06b623242e

    • SHA512

      382d7c4a51d2e9566a2577e08ab5624056ce872ac8ede42812059601985415326fb0ea2c304fb09f908484b1dbba18b91121982520ef882618bdde7169fcff6c

    • SSDEEP

      24576:FqDEvCTbMWu7rQYlBQcBiT6rprG8afw1YisS/6dL:FTvC/MTQYxsWR7afDiqd

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks