General

  • Target

    c20046a5e5da38647ee18263ac2cbe72a6312d3cb53a9e38c9a11f187d6e4bd0.exe

  • Size

    1.1MB

  • Sample

    240730-cy2qjsshmr

  • MD5

    cea6b9b2094a9a223f82c25eb72ed9a7

  • SHA1

    cc6ee395bcfe0c4e8980f46369761123af508072

  • SHA256

    c20046a5e5da38647ee18263ac2cbe72a6312d3cb53a9e38c9a11f187d6e4bd0

  • SHA512

    ce1b97cd97d350894ffa0ece8bbb8f1c0b572bd2fbb4b729007a3f46323251ee6ba895cf1b35c7ce08301996275ab45b616ad441cf558fd5ea32ba92034eb6af

  • SSDEEP

    24576:SqDEvCTbMWu7rQYlBQcBiT6rprG8aorw9gKsyVTDr02ZUhZ0:STvC/MTQYxsWR7ao/cVTDr0JP

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pt46

Decoy

twinportslocal.com

rovor.store

98169.club

mdywl.com

jrd3s.rest

aston1717.top

floridawoodworkingmachinery.com

17tk555t.com

ankitsho.shop

seclameh.com

realrecordlabel.com

trenchonbirmingham.com

af28.top

rtp1kenzototo.com

theselflovesite.com

promotegetpaid.info

strategiclogisticsagency.com

learneracademy.net

per-watch.com

betbox2341.com

Targets

    • Target

      c20046a5e5da38647ee18263ac2cbe72a6312d3cb53a9e38c9a11f187d6e4bd0.exe

    • Size

      1.1MB

    • MD5

      cea6b9b2094a9a223f82c25eb72ed9a7

    • SHA1

      cc6ee395bcfe0c4e8980f46369761123af508072

    • SHA256

      c20046a5e5da38647ee18263ac2cbe72a6312d3cb53a9e38c9a11f187d6e4bd0

    • SHA512

      ce1b97cd97d350894ffa0ece8bbb8f1c0b572bd2fbb4b729007a3f46323251ee6ba895cf1b35c7ce08301996275ab45b616ad441cf558fd5ea32ba92034eb6af

    • SSDEEP

      24576:SqDEvCTbMWu7rQYlBQcBiT6rprG8aorw9gKsyVTDr02ZUhZ0:STvC/MTQYxsWR7ao/cVTDr0JP

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks