General

  • Target

    5903a6e132492859e71ad0542938af1fe807e0110fdb132725b7e6fbf5e94b5e.exe

  • Size

    1.1MB

  • Sample

    240821-mdrd7awhkk

  • MD5

    471a314fd2f309be7ab062044e12f0de

  • SHA1

    c1058e3787505af5a4df68653625158f8c8ac4b2

  • SHA256

    5903a6e132492859e71ad0542938af1fe807e0110fdb132725b7e6fbf5e94b5e

  • SHA512

    f12355bcb0c732dcb1f70abae4de91210cbbb8711884b2593048cf5edee0d08a2db64eeec8f8f127ad33e58eeeab6b9eeb577478c037efdedc0b3a0051994fef

  • SSDEEP

    24576:qqDEvCTbMWu7rQYlBQcBiT6rprG8aWnmfArkK/yaFuR6i:qTvC/MTQYxsWR7aW/rk9auQ

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pt46

Decoy

twinportslocal.com

rovor.store

98169.club

mdywl.com

jrd3s.rest

aston1717.top

floridawoodworkingmachinery.com

17tk555t.com

ankitsho.shop

seclameh.com

realrecordlabel.com

trenchonbirmingham.com

af28.top

rtp1kenzototo.com

theselflovesite.com

promotegetpaid.info

strategiclogisticsagency.com

learneracademy.net

per-watch.com

betbox2341.com

Targets

    • Target

      5903a6e132492859e71ad0542938af1fe807e0110fdb132725b7e6fbf5e94b5e.exe

    • Size

      1.1MB

    • MD5

      471a314fd2f309be7ab062044e12f0de

    • SHA1

      c1058e3787505af5a4df68653625158f8c8ac4b2

    • SHA256

      5903a6e132492859e71ad0542938af1fe807e0110fdb132725b7e6fbf5e94b5e

    • SHA512

      f12355bcb0c732dcb1f70abae4de91210cbbb8711884b2593048cf5edee0d08a2db64eeec8f8f127ad33e58eeeab6b9eeb577478c037efdedc0b3a0051994fef

    • SSDEEP

      24576:qqDEvCTbMWu7rQYlBQcBiT6rprG8aWnmfArkK/yaFuR6i:qTvC/MTQYxsWR7aW/rk9auQ

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks