General

  • Target

    5672cebe337b0692893b95b73f534c37.bin

  • Size

    597KB

  • Sample

    240914-blsfnszela

  • MD5

    bc4dae03308e2740829296ee222d1f7f

  • SHA1

    77257c8b8101cd18d28b260cc42b80c3bd34a8f6

  • SHA256

    d4d33429392805cc53ef476e5e5d46fa8efb4816f21bfe8503b398544eec7535

  • SHA512

    631aff392565e250df5fc10a90ef3f756910578424a0528195e00b1328d8f7cc7e59bc1a0caffe5f3d3b2d11f1aa4fe3d09e1457f72935e39d04981113521b76

  • SSDEEP

    12288:eRa4cJyF6nNj47SbONtIgVcqeMcXF8kxocOJg/dupJzyRwM:sMJyYnNB5gLeLVohJgcpJzyRX

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

d16h

Decoy

iki-graphy.online

l8z8c.vip

1709.asia

inematography-course-72246.bond

pis3noe2e.sbs

wernv.xyz

ovepepe.xyz

ama-online.world

ookmouse.fun

harkclothingdesigns.xyz

bbvvjuiqew.bond

sed-cars-93620.bond

esgateeganhe.shop

cekmeledak.info

ebulahorizon.buzz

peakers-92991.bond

essislotgoal16.top

hafi.biz

ichunyang.club

lrica.net

Targets

    • Target

      8d4982f32dffdff70405b3185f7a3e6ca96c596663576ca85c1f8dae9352e3b3.exe

    • Size

      654KB

    • MD5

      5672cebe337b0692893b95b73f534c37

    • SHA1

      4f5927d48e797140ae87831e4ba2dcb6df172db7

    • SHA256

      8d4982f32dffdff70405b3185f7a3e6ca96c596663576ca85c1f8dae9352e3b3

    • SHA512

      285b168f7259f35e1fb5dfd41b21a6d6972447f0fe70252f80127866385abd89dd09add944c56627c3e412e4caed5785b327cc09da058dbad3fac5eff968fe16

    • SSDEEP

      12288:Gw6kSRPc/iXyDuHRVYUDD4xydC7jKr1xFkIduA1A9:169R0/iXc+RlYxydC78xFAG

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks