General

  • Target

    d2b2b2ae2cf256bec969052f108726d12ce6f84a2ca91f4baf4683a5bb331c86.exe

  • Size

    622KB

  • Sample

    240904-pzmz1a1gra

  • MD5

    23b359fd43f7e0a663007671601efa72

  • SHA1

    7e848ca75edc87be39185399fc6888cacbb94fc4

  • SHA256

    d2b2b2ae2cf256bec969052f108726d12ce6f84a2ca91f4baf4683a5bb331c86

  • SHA512

    51bfd603ad20235cd9faad812915f028d21c164a64d7e535b4663ea2eb52324350585ce52604387bc489590128621d918464ca28c203b9aae89f764bc70d7820

  • SSDEEP

    12288:NiuaKWgPg9M4AzmHJoQNo9hP+RRsf9uL1tEEE8TRAmxH:0ngo9M4AqA9h2RRQ23PnTRAm

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

v15n

Decoy

dyahwoahjuk.store

toysstorm.com

y7rak9.com

2222233p6.shop

betbox2341.com

visualvarta.com

nijssenadventures.com

main-12.site

leng4d.net

kurainu.xyz

hatesa.xyz

culturamosaica.com

supermallify.store

gigboard.app

rxforgive.com

ameliestones.com

kapalwin.live

tier.credit

sobol-ksa.com

faredeal.online

Targets

    • Target

      d2b2b2ae2cf256bec969052f108726d12ce6f84a2ca91f4baf4683a5bb331c86.exe

    • Size

      622KB

    • MD5

      23b359fd43f7e0a663007671601efa72

    • SHA1

      7e848ca75edc87be39185399fc6888cacbb94fc4

    • SHA256

      d2b2b2ae2cf256bec969052f108726d12ce6f84a2ca91f4baf4683a5bb331c86

    • SHA512

      51bfd603ad20235cd9faad812915f028d21c164a64d7e535b4663ea2eb52324350585ce52604387bc489590128621d918464ca28c203b9aae89f764bc70d7820

    • SSDEEP

      12288:NiuaKWgPg9M4AzmHJoQNo9hP+RRsf9uL1tEEE8TRAmxH:0ngo9M4AqA9h2RRQ23PnTRAm

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks