General

  • Target

    fc0811ee2baf6763e128641ee0499160N.exe

  • Size

    726KB

  • Sample

    240905-25w63stcnr

  • MD5

    fc0811ee2baf6763e128641ee0499160

  • SHA1

    40f7134e7ea292bd068145155796b396c8537af4

  • SHA256

    4a43e11ef89937899b693503f07525735c54e122053b9a9384a55df403c930af

  • SHA512

    594292b3d0665fc340981f59b0d8c9621d1eaba9ae5b06d8c6a1d85dde940ea2f15aeca3adbbcb33656caedf1d35e78d38e7c852b64e30ab672c2424836ebc85

  • SSDEEP

    12288:zUpOJEqPeu6bYTReSqs9dzQl3BkobD/gZ0z:YpaEqPeu0GRks7SBzbDG0

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ucze

Decoy

motorcyclemagician.com

powerreport.xyz

ychfgdne.icu

presentschein.com

seabreathing.com

stlukeyouth.com

ifixconstruction.repair

thietbikhaithacdatuanphat.com

hexdeville.com

xn--planungsbro-stanko-u6b.net

elisebruneau.com

yxflwwbvz.icu

wafirainteriors.com

hexok.com

krewedubethkevin.com

lassilacgi.com

bestvolvowebsite.com

clarissajaneen.com

foreverchemicallawsuit.com

ebizkendra.com

Targets

    • Target

      fc0811ee2baf6763e128641ee0499160N.exe

    • Size

      726KB

    • MD5

      fc0811ee2baf6763e128641ee0499160

    • SHA1

      40f7134e7ea292bd068145155796b396c8537af4

    • SHA256

      4a43e11ef89937899b693503f07525735c54e122053b9a9384a55df403c930af

    • SHA512

      594292b3d0665fc340981f59b0d8c9621d1eaba9ae5b06d8c6a1d85dde940ea2f15aeca3adbbcb33656caedf1d35e78d38e7c852b64e30ab672c2424836ebc85

    • SSDEEP

      12288:zUpOJEqPeu6bYTReSqs9dzQl3BkobD/gZ0z:YpaEqPeu0GRks7SBzbDG0

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks