General

  • Target

    COMMERCAILINVOICEANDDHLAWBTRACKINGDETAILS.exe

  • Size

    1.1MB

  • Sample

    240725-yb9njatdmh

  • MD5

    5ec011058b0884bc3b13563f97231c58

  • SHA1

    9846a460d630ea60c476df6dc92ae10d902bb54f

  • SHA256

    bc5a7642799c2f22d513dc19fb87848ecbe002f1815b2d5fd3a5af3fdbcdf0ae

  • SHA512

    d3172fe1fc90a3e8e4331bb4eeae03377825e26a815636c8931890fa9c1f8290eafa8c293e22b218d37f79a9202e62c5a5b13df40a14ebb828814a3797262523

  • SSDEEP

    24576:gqDEvCTbMWu7rQYlBQcBiT6rprG8apamXjozThdab7:gTvC/MTQYxsWR7ap7wn

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jd21

Decoy

thepowerofzeus.com

tampamlr.com

00050591.xyz

dominomusicmktlnc.com

ai-defi.wiki

tyumk.xyz

gbqspj.club

fostertv.net

batremake.com

nelwhiteconsulting.com

amsya.com

urbanholidayz.com

463058.photos

anag-gioielli.com

kjsdhklssk73.xyz

islarenta.com

designed4lifecoaching.com

autohotelsecrets.com

susansellsmarin.com

studyflow.xyz

Targets

    • Target

      COMMERCAILINVOICEANDDHLAWBTRACKINGDETAILS.exe

    • Size

      1.1MB

    • MD5

      5ec011058b0884bc3b13563f97231c58

    • SHA1

      9846a460d630ea60c476df6dc92ae10d902bb54f

    • SHA256

      bc5a7642799c2f22d513dc19fb87848ecbe002f1815b2d5fd3a5af3fdbcdf0ae

    • SHA512

      d3172fe1fc90a3e8e4331bb4eeae03377825e26a815636c8931890fa9c1f8290eafa8c293e22b218d37f79a9202e62c5a5b13df40a14ebb828814a3797262523

    • SSDEEP

      24576:gqDEvCTbMWu7rQYlBQcBiT6rprG8apamXjozThdab7:gTvC/MTQYxsWR7ap7wn

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks