General

  • Target

    3e9f3a83f830c41cfec094e86c31a8c79c032814a4f029eba014cf90b7db75ab.exe

  • Size

    615KB

  • Sample

    240802-zda4esygnp

  • MD5

    1cc3edbb74f2ee6d727579c246057f95

  • SHA1

    2e7ee47afb0752c640b598f5bb7efada674af88d

  • SHA256

    3e9f3a83f830c41cfec094e86c31a8c79c032814a4f029eba014cf90b7db75ab

  • SHA512

    4fd715f9487daba8cfe32f4463cc675cf681a1377a2c1d097d74aa8bf63c54cd8f510761b4d49d6259ae315ab66670684b216d4d6217cd0a4cd5925cf3123de4

  • SSDEEP

    12288:NeFFFFFFFF6VxOpnAArP4R1PiXQF7wxqMrI3NL/P9IqeiT/ihYWZRvYZo+5oK:NeFFFFFFFF6VwaArwRA+wgMr6lP93eiF

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sy52

Decoy

wxxj.asia

emu-oil.online

theprogressiontalks.com

saigonvape.com

cb257.pro

inucana.com

xn--pdr89n.vip

vtc.bzh

connexionsink.com

mastersofthevibes.com

mallsetuae.shop

bellaandbling.com

wagi88.one

273618.bid

japanvietnam-mall.com

lkd1t.rest

oflgjgiq.xyz

calliblography.com

idz8u.vip

marrybears.com

Targets

    • Target

      3e9f3a83f830c41cfec094e86c31a8c79c032814a4f029eba014cf90b7db75ab.exe

    • Size

      615KB

    • MD5

      1cc3edbb74f2ee6d727579c246057f95

    • SHA1

      2e7ee47afb0752c640b598f5bb7efada674af88d

    • SHA256

      3e9f3a83f830c41cfec094e86c31a8c79c032814a4f029eba014cf90b7db75ab

    • SHA512

      4fd715f9487daba8cfe32f4463cc675cf681a1377a2c1d097d74aa8bf63c54cd8f510761b4d49d6259ae315ab66670684b216d4d6217cd0a4cd5925cf3123de4

    • SSDEEP

      12288:NeFFFFFFFF6VxOpnAArP4R1PiXQF7wxqMrI3NL/P9IqeiT/ihYWZRvYZo+5oK:NeFFFFFFFF6VwaArwRA+wgMr6lP93eiF

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks