General

  • Target

    OfficialSalaryfortheMonthofAugust2024-NU1622662404290592.exe

  • Size

    1.1MB

  • Sample

    240818-weh9mswcke

  • MD5

    dd51ef4d9a4169038673c7f657f2f9c5

  • SHA1

    f7d28cf5ad8a036ab851f4f836159235fd22b60c

  • SHA256

    49bae482a9eeeb1792f15f03abbc8e6454d6b7e9fd78dbf7f3081d8dbaa9d450

  • SHA512

    827c4cb8eceaf42a18084741cc1f50dd593741c53015392863d5fc3dd3f301910bbf0a979909e36289b649b837aa35609994b3d21d40d2b58865ab8f7bc1c686

  • SSDEEP

    24576:2qDEvCTbMWu7rQYlBQcBiT6rprG8aojxwBfcZW//g50hU:2TvC/MTQYxsWR7ao+v4mh

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pt46

Decoy

twinportslocal.com

rovor.store

98169.club

mdywl.com

jrd3s.rest

aston1717.top

floridawoodworkingmachinery.com

17tk555t.com

ankitsho.shop

seclameh.com

realrecordlabel.com

trenchonbirmingham.com

af28.top

rtp1kenzototo.com

theselflovesite.com

promotegetpaid.info

strategiclogisticsagency.com

learneracademy.net

per-watch.com

betbox2341.com

Targets

    • Target

      OfficialSalaryfortheMonthofAugust2024-NU1622662404290592.exe

    • Size

      1.1MB

    • MD5

      dd51ef4d9a4169038673c7f657f2f9c5

    • SHA1

      f7d28cf5ad8a036ab851f4f836159235fd22b60c

    • SHA256

      49bae482a9eeeb1792f15f03abbc8e6454d6b7e9fd78dbf7f3081d8dbaa9d450

    • SHA512

      827c4cb8eceaf42a18084741cc1f50dd593741c53015392863d5fc3dd3f301910bbf0a979909e36289b649b837aa35609994b3d21d40d2b58865ab8f7bc1c686

    • SSDEEP

      24576:2qDEvCTbMWu7rQYlBQcBiT6rprG8aojxwBfcZW//g50hU:2TvC/MTQYxsWR7ao+v4mh

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks