General

  • Target

    Etisalat Summary Bill for the Month of August.exe

  • Size

    1.1MB

  • Sample

    240830-kbabsavalc

  • MD5

    df6915639adaa48dad6b5cad220f1b73

  • SHA1

    b7780024fb645196808de54fcb3d48a5581c026d

  • SHA256

    a73dc341737a15724833932b844ce4444908158b2b6056386798e440235364db

  • SHA512

    c6951e5781c2fe9211863d51872bd135bf9ca67bbc40c2e613642fb102103ad396167e2ab725055cdff6dcd6f2499a0b2a70ba3400602d29bcbcf0d5cabe269f

  • SSDEEP

    24576:uqDEvCTbMWu7rQYlBQcBiT6rprG8aRo8Awaa:uTvC/MTQYxsWR7aRo8n

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pt46

Decoy

twinportslocal.com

rovor.store

98169.club

mdywl.com

jrd3s.rest

aston1717.top

floridawoodworkingmachinery.com

17tk555t.com

ankitsho.shop

seclameh.com

realrecordlabel.com

trenchonbirmingham.com

af28.top

rtp1kenzototo.com

theselflovesite.com

promotegetpaid.info

strategiclogisticsagency.com

learneracademy.net

per-watch.com

betbox2341.com

Targets

    • Target

      Etisalat Summary Bill for the Month of August.exe

    • Size

      1.1MB

    • MD5

      df6915639adaa48dad6b5cad220f1b73

    • SHA1

      b7780024fb645196808de54fcb3d48a5581c026d

    • SHA256

      a73dc341737a15724833932b844ce4444908158b2b6056386798e440235364db

    • SHA512

      c6951e5781c2fe9211863d51872bd135bf9ca67bbc40c2e613642fb102103ad396167e2ab725055cdff6dcd6f2499a0b2a70ba3400602d29bcbcf0d5cabe269f

    • SSDEEP

      24576:uqDEvCTbMWu7rQYlBQcBiT6rprG8aRo8Awaa:uTvC/MTQYxsWR7aRo8n

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks