General

  • Target

    MalwareBazaar.2

  • Size

    1.2MB

  • Sample

    240806-vjx3xsybqe

  • MD5

    6b4c8e0e5006698940118d954da9ea6b

  • SHA1

    c9c1b519d8c44a25c14f054660a14a8c73f11ee4

  • SHA256

    461a2375bc1ab191cca91667ea8aecd498fad2b524bc81ca49eb7d5674063331

  • SHA512

    7484cc2ea73961b39462c9973ba79f57bf5741405f35b1a31b9a2e238cbb2e4ab082e72a46a70b5f3a5365c40ee95eabddf6c594f5159e41cb970431d6b5546b

  • SSDEEP

    24576:EqDEvCTbMWu7rQYlBQcBiT6rprG8aul4pf4edYK:ETvC/MTQYxsWR7aucTO

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pt46

Decoy

twinportslocal.com

rovor.store

98169.club

mdywl.com

jrd3s.rest

aston1717.top

floridawoodworkingmachinery.com

17tk555t.com

ankitsho.shop

seclameh.com

realrecordlabel.com

trenchonbirmingham.com

af28.top

rtp1kenzototo.com

theselflovesite.com

promotegetpaid.info

strategiclogisticsagency.com

learneracademy.net

per-watch.com

betbox2341.com

Targets

    • Target

      MalwareBazaar.2

    • Size

      1.2MB

    • MD5

      6b4c8e0e5006698940118d954da9ea6b

    • SHA1

      c9c1b519d8c44a25c14f054660a14a8c73f11ee4

    • SHA256

      461a2375bc1ab191cca91667ea8aecd498fad2b524bc81ca49eb7d5674063331

    • SHA512

      7484cc2ea73961b39462c9973ba79f57bf5741405f35b1a31b9a2e238cbb2e4ab082e72a46a70b5f3a5365c40ee95eabddf6c594f5159e41cb970431d6b5546b

    • SSDEEP

      24576:EqDEvCTbMWu7rQYlBQcBiT6rprG8aul4pf4edYK:ETvC/MTQYxsWR7aucTO

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks