General

  • Target

    7e27edc8405ad4fdfcf6d5de75046b0dace6386f05dac3382629b0692274f861.exe

  • Size

    1.1MB

  • Sample

    240809-w3sg8axfme

  • MD5

    b0896ccaf97625a546e53df07bb98769

  • SHA1

    39d66b58804ff0f1b600b910713118041f0ddd4b

  • SHA256

    7e27edc8405ad4fdfcf6d5de75046b0dace6386f05dac3382629b0692274f861

  • SHA512

    2aa7ead5dd4ef225acecd4d56d1735b7041e1e772e5c82f177561638d262daeff4aca86c14a1b1bcaef5d4cf538d65b3bd0d5842a3382559d7727a379f74e50f

  • SSDEEP

    24576:1qDEvCTbMWu7rQYlBQcBiT6rprG8acGCRB5I89:1TvC/MTQYxsWR7acjp

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cn14

Decoy

fgfdwr254u.xyz

arm-uk.com

qoachu.com

radiantpm.christmas

ghacor.delivery

lindasartgmbh.com

agroguasch.com

silverlinedevelopment.net

1000thb.com

bremwq.xyz

qweuiop.top

dental-implants-21860.bond

elotesaguafria.com

biagiottifraticelli.com

pureleafworks.com

mokomusic.com

lunarqr.shop

bestbuyprods.com

michaelsec.com

morganstore.net

Targets

    • Target

      7e27edc8405ad4fdfcf6d5de75046b0dace6386f05dac3382629b0692274f861.exe

    • Size

      1.1MB

    • MD5

      b0896ccaf97625a546e53df07bb98769

    • SHA1

      39d66b58804ff0f1b600b910713118041f0ddd4b

    • SHA256

      7e27edc8405ad4fdfcf6d5de75046b0dace6386f05dac3382629b0692274f861

    • SHA512

      2aa7ead5dd4ef225acecd4d56d1735b7041e1e772e5c82f177561638d262daeff4aca86c14a1b1bcaef5d4cf538d65b3bd0d5842a3382559d7727a379f74e50f

    • SSDEEP

      24576:1qDEvCTbMWu7rQYlBQcBiT6rprG8acGCRB5I89:1TvC/MTQYxsWR7acjp

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks