General

  • Target

    dc7ebbb50daeb8d518dc37a89775ffd1062b0b40014afa69ff2195370fb2f30d.exe

  • Size

    592KB

  • Sample

    240910-crrxrstfkb

  • MD5

    a796e201c6de52790bf473c385efb84d

  • SHA1

    5eea79136a8a337ab43a88d21e55f92b2db74718

  • SHA256

    dc7ebbb50daeb8d518dc37a89775ffd1062b0b40014afa69ff2195370fb2f30d

  • SHA512

    74a979c90fe4d650f89b379fdb18a7e8003d8bc6b22bf3d36de4b57a6d6c7488eb85b476243550d4360e22886741332c2462b99bdf50a00040a048094fd4d89a

  • SSDEEP

    12288:S1xTx3j5DTx7EXuE331INsSB9HsP5A0cClmkDt1pDttlp9i72l:qHFkuK32ftW5A0cEm0ZFkE

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

b31a

Decoy

enjamin-paaac.buzz

mail-marketing-40950.bond

pusems28-post.cyou

hindo.top

ruck-company-be.today

asinos-deutschland.net

ewancash.boats

etdopovo.casino

rcher-saaac.buzz

871166.vip

manuel.app

g3yqo.shop

-9way.xyz

qawgytfexe.bond

iefi6834.vip

ental-health-35901.bond

idat-merkez18.top

rojectleadzone.website

lirudolph.top

migloballlc.online

Targets

    • Target

      dc7ebbb50daeb8d518dc37a89775ffd1062b0b40014afa69ff2195370fb2f30d.exe

    • Size

      592KB

    • MD5

      a796e201c6de52790bf473c385efb84d

    • SHA1

      5eea79136a8a337ab43a88d21e55f92b2db74718

    • SHA256

      dc7ebbb50daeb8d518dc37a89775ffd1062b0b40014afa69ff2195370fb2f30d

    • SHA512

      74a979c90fe4d650f89b379fdb18a7e8003d8bc6b22bf3d36de4b57a6d6c7488eb85b476243550d4360e22886741332c2462b99bdf50a00040a048094fd4d89a

    • SSDEEP

      12288:S1xTx3j5DTx7EXuE331INsSB9HsP5A0cClmkDt1pDttlp9i72l:qHFkuK32ftW5A0cEm0ZFkE

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks