General

  • Target

    5cbd8d9ed7f11fe6795e4e47cc23b390N.exe

  • Size

    1.1MB

  • Sample

    240904-b1hvsatera

  • MD5

    5cbd8d9ed7f11fe6795e4e47cc23b390

  • SHA1

    adb77874bd930fb48291c9822277640c5e0452a1

  • SHA256

    ad796730fe76da567b892419b2cdba44eeaef29bf62b637c3c3af4cce42886ce

  • SHA512

    9128e4ca530669884e7a6b148a1245183442ec59f1a4ffb152868298a2a14e99afd34ab887ec821fc5e343a74fbdcbbdb19f21b1109809a33f65ec73a8e43799

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHagYFIuXO+mzds6i05:gh+ZkldoPK8YagYRXye65

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pt46

Decoy

twinportslocal.com

rovor.store

98169.club

mdywl.com

jrd3s.rest

aston1717.top

floridawoodworkingmachinery.com

17tk555t.com

ankitsho.shop

seclameh.com

realrecordlabel.com

trenchonbirmingham.com

af28.top

rtp1kenzototo.com

theselflovesite.com

promotegetpaid.info

strategiclogisticsagency.com

learneracademy.net

per-watch.com

betbox2341.com

Targets

    • Target

      5cbd8d9ed7f11fe6795e4e47cc23b390N.exe

    • Size

      1.1MB

    • MD5

      5cbd8d9ed7f11fe6795e4e47cc23b390

    • SHA1

      adb77874bd930fb48291c9822277640c5e0452a1

    • SHA256

      ad796730fe76da567b892419b2cdba44eeaef29bf62b637c3c3af4cce42886ce

    • SHA512

      9128e4ca530669884e7a6b148a1245183442ec59f1a4ffb152868298a2a14e99afd34ab887ec821fc5e343a74fbdcbbdb19f21b1109809a33f65ec73a8e43799

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHagYFIuXO+mzds6i05:gh+ZkldoPK8YagYRXye65

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks