General

  • Target

    Payment Details.exe

  • Size

    1.1MB

  • Sample

    240828-krk38asbne

  • MD5

    3e2da7be0bae852fd8be27e3b0b2c5e6

  • SHA1

    134e1f6951393ebe1037361d03a395231da2db99

  • SHA256

    633defdc371a3cfd3641fd09c17ed6c0c9b8634ddb8d2de5c24a9393ac37e05a

  • SHA512

    823e77f4a8d51adbb264bac1cda48dd16e2bb0d429033c9a94d272558e8d7e7ab53df4def20fdf50b3f9b6f64c8d1aa5cbdc65e0f6214cba2263817ff9a3af5d

  • SSDEEP

    24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8ajPa7PUv8l:DTvC/MTQYxsWR7ajI

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pt46

Decoy

twinportslocal.com

rovor.store

98169.club

mdywl.com

jrd3s.rest

aston1717.top

floridawoodworkingmachinery.com

17tk555t.com

ankitsho.shop

seclameh.com

realrecordlabel.com

trenchonbirmingham.com

af28.top

rtp1kenzototo.com

theselflovesite.com

promotegetpaid.info

strategiclogisticsagency.com

learneracademy.net

per-watch.com

betbox2341.com

Targets

    • Target

      Payment Details.exe

    • Size

      1.1MB

    • MD5

      3e2da7be0bae852fd8be27e3b0b2c5e6

    • SHA1

      134e1f6951393ebe1037361d03a395231da2db99

    • SHA256

      633defdc371a3cfd3641fd09c17ed6c0c9b8634ddb8d2de5c24a9393ac37e05a

    • SHA512

      823e77f4a8d51adbb264bac1cda48dd16e2bb0d429033c9a94d272558e8d7e7ab53df4def20fdf50b3f9b6f64c8d1aa5cbdc65e0f6214cba2263817ff9a3af5d

    • SSDEEP

      24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8ajPa7PUv8l:DTvC/MTQYxsWR7ajI

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks