General

  • Target

    3e3b336f5ed4dca0fbad6fa2dd7d479974d15f106688756b1663d969f266ad24

  • Size

    721KB

  • Sample

    240830-gcf9yazgqj

  • MD5

    0825498f1ff625cb0436525b8c8f761c

  • SHA1

    27847eeac7bbf48e22bd6ac482ff1479c2ea2a48

  • SHA256

    3e3b336f5ed4dca0fbad6fa2dd7d479974d15f106688756b1663d969f266ad24

  • SHA512

    8f4ed0850bab64457b5637e73d70ecf9a286a278d648919af3b23748231992694a30dec6329f69e75f5cfd2606fae2513ffad99dd3498d69fb60ae7c2d4a0f39

  • SSDEEP

    12288:Smltr3r4QW2U5LUTAKxG0U1cl62S7C9NZBBMq5cHV/a822Te3SsKV1svI8/:SEr3r4QWN0dU1cC7+BQ082osnIe

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pt46

Decoy

twinportslocal.com

rovor.store

98169.club

mdywl.com

jrd3s.rest

aston1717.top

floridawoodworkingmachinery.com

17tk555t.com

ankitsho.shop

seclameh.com

realrecordlabel.com

trenchonbirmingham.com

af28.top

rtp1kenzototo.com

theselflovesite.com

promotegetpaid.info

strategiclogisticsagency.com

learneracademy.net

per-watch.com

betbox2341.com

Targets

    • Target

      Etisalat Summary Bill for the Month of August.exe

    • Size

      1.1MB

    • MD5

      df6915639adaa48dad6b5cad220f1b73

    • SHA1

      b7780024fb645196808de54fcb3d48a5581c026d

    • SHA256

      a73dc341737a15724833932b844ce4444908158b2b6056386798e440235364db

    • SHA512

      c6951e5781c2fe9211863d51872bd135bf9ca67bbc40c2e613642fb102103ad396167e2ab725055cdff6dcd6f2499a0b2a70ba3400602d29bcbcf0d5cabe269f

    • SSDEEP

      24576:uqDEvCTbMWu7rQYlBQcBiT6rprG8aRo8Awaa:uTvC/MTQYxsWR7aRo8n

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks