General

  • Target

    88489f399a91cf02b01012981cd1cec452c0e885d6c5728892f45920fdc68b66

  • Size

    619KB

  • Sample

    240905-w8mh6axapl

  • MD5

    b05e69f3097cca79ad00975f23584b72

  • SHA1

    267199a0facb1977816515a375c0a55812c3c779

  • SHA256

    88489f399a91cf02b01012981cd1cec452c0e885d6c5728892f45920fdc68b66

  • SHA512

    d94a5536595092e4cd903cf0c77ed4de470cb83106e04b259451231012508dfdb89a0b3b3ebec4cce05497c6e7e5259c60dfc257d6f1f9657a38ef51899cd53f

  • SSDEEP

    12288:PPHK2pY0ki8yv72QDhfVmuc4N8iS1C9Em434TIyVOiXnVqqY:PPlK0ZHtfPHErQpOiXVpY

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

j01s

Decoy

ransportationmtsmtpro.top

v-camper-motorhomes-77740.bond

vrepairmumbai.shop

hocosmooth.xyz

etirementplanning01.today

ompralojaonline.shop

ransportationmpmptpro.top

hehomeownermanuel.info

oppr.fit

ilmynadin.cfd

ontrol-bipolar-treatments.club

eorge-saaab.buzz

ose-ferrer.online

16au612ch.bond

y0015.net

ksdnhe58w.top

epression-treatment-75701.bond

illagin.shop

xahf.top

vzpbty.buzz

Targets

    • Target

      Creative Artists Agency.exe

    • Size

      675KB

    • MD5

      aaa655302b6609a7b315fa61817de31d

    • SHA1

      ac8d992f82e2b959c12e570eafef8e8ad751fe80

    • SHA256

      e3b137b034830c5189138a584ad99c6710a65e30d94779c92a1610c3d7de97ad

    • SHA512

      fdc0b8163622b9471b44857cbf791e25e142ad1dbe9e56d3ca8bc994d33dc8069abf0c244f84c0153182de52415a95c636cd0a2384d98b6cc9d6244cba6186cc

    • SSDEEP

      12288:Gqux1UoIG5MPUXaewhSi2FWMTaiPNhkl5Wq2xChiss1dVxunRgjcbGq965c:gUobysaewhSi4TNPNhkl59WChNCBugj8

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks