General

  • Target

    745adf93af99455428f520e84dc1c8cb3715f5fbdfa80a4b52c41e0c0b748025

  • Size

    619KB

  • Sample

    240901-ear8ba1anq

  • MD5

    c03ccb2f4a498f214f7d3cd54d951b85

  • SHA1

    5e533eb4de8cf3f357bea3c3a334c08e90c073fa

  • SHA256

    745adf93af99455428f520e84dc1c8cb3715f5fbdfa80a4b52c41e0c0b748025

  • SHA512

    513150d4e628a87ec3873dac6a24a14b98be8fb14ee23e29da3d1703345954c137deb0832f6153e45aa056334e15be70b805e70c549b247900c882e62930902f

  • SSDEEP

    12288:7rj8ESVtvLGINzhPdf0aH2MgZGoaxvpMRUuDTIFaRvI+hhzMRnJWCj:7rjk/CINzhPdP29ZexvryTIFaIO+RnJn

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bi05

Decoy

ollow-the-bit.online

aopho.autos

14ra567dp.autos

48651301.top

ussian-dating-54714.bond

sychology-degree-80838.bond

lytracker.xyz

strology-forest.sbs

swjbcl3.top

ridgenexttechnologies.partners

lroy.sbs

kyscreen.vip

anhit.live

uckyheart.xyz

orddserials.online

hetune.shop

nherited-traits-ant.bond

stanaslot-1.xyz

sychologist-therapy-36914.bond

iandramonami.net

Targets

    • Target

      7d58c8bd03c166d6a74bcec471538b4803d1ca9aa9d32f5a5286dd5aafea62ce.exe

    • Size

      1.0MB

    • MD5

      4472308b26d97576bda38ee8976036af

    • SHA1

      69f68ae82ffa3d8804aed31ce151efb26a74a8c1

    • SHA256

      7d58c8bd03c166d6a74bcec471538b4803d1ca9aa9d32f5a5286dd5aafea62ce

    • SHA512

      fdaf2e5c1aa93e67798fe99725cac4da3898be74e76eb22440b6bcce6ab064fcd73f1a25581f0ca4ae16e9f527927f661ad18dd5ef27d3fa0f4a2c9799befa32

    • SSDEEP

      24576:Ftb20pkaCqT5TBWgNQ7aIsWLhU/b5bTj6A:2Vg5tQ7aI7hS5

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks